WordPress Plugin Unauthenticated Admin Cookie Injection

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The AutoNetTV Relay WordPress plugin before version 3.0.14 contains a critical authentication bypass vulnerability (CWE-287) that allows unauthenticated attackers to gain administrator access. The plugin fails to validate user capabilities or authentication status before setting an administrator authentication cookie during scheduled content-synchronization tasks. On vulnerable server configurations where scheduled tasks execute before HTTP response commitment, an attacker can trigger the due task and intercept the administrator session cookie, bypassing all credential requirements. This affects any WordPress installation using the vulnerable plugin version, potentially exposing sensitive content management, user data, and site configuration to unauthorized modification and access.

Casky's 283 mapped security skills detect this vulnerability pattern by analyzing two critical MITRE ATT&CK techniques: TA0004 (Privilege Escalation) and TA0006 (Credential Access). Using Claude AI with extended reasoning, practitioners would identify suspicious patterns including: (1) unauthenticated requests triggering administrative functions without proper capability checks, (2) authentication cookies being set outside normal login workflows, (3) scheduled task execution paths that bypass standard WordPress authentication hooks, and (4) timing-based race conditions between task execution and HTTP response handling. Casky's skill coverage enables detection of the initial access vector through unauthenticated privilege escalation, credential exposure through session cookie interception, and lateral movement indicators when administrator accounts suddenly perform unusual actions. Findings would highlight the absence of nonce validation, missing current_user_can() checks, and improper reliance on scheduled task execution ordering—enabling teams to identify vulnerable plugin versions and suspicious session activity in logs before attackers establish persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13600.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-13600

Casky has 283 skills that investigate the attack patterns behind CVE-2026-13600. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn