CheckView Plugin REST API Authentication Bypass

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-18786 is a critical authentication bypass vulnerability in the CheckView WordPress plugin that allows unauthenticated attackers to circumvent REST API nonce validation. The flaw stems from an overly broad authentication filter that discards authentication errors for any request containing CheckView-specific strings in the URI, regardless of whether the request targets CheckView routes. This enables attackers to craft malicious links that perform privileged REST actions—such as creating administrator accounts—without valid credentials. Any WordPress installation running CheckView before version 2.3.2 is at risk, particularly those exposed to untrusted user inputs or social engineering attacks that trick administrators into clicking crafted links.

Casky's 283 mapped skills detect the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0004) and Execution (TA0006) phases. Practitioners using Casky would identify suspicious REST API requests exhibiting CWE-287 (Improper Authentication) indicators: unauthenticated requests with valid administrative permissions, URI manipulation patterns containing plugin-specific markers, and anomalous nonce validation failures. The platform's Claude-powered analysis would correlate request signatures showing privilege escalation attempts (account creation, permission modifications) originating from unauthenticated sessions, alongside token bypass indicators. Security teams would surface findings highlighting the absence of proper origin validation and the dangerous practice of globally applying authentication filters, enabling detection of both exploit attempts and similar architectural weaknesses in custom plugins.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18786.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-18786

Casky has 283 skills that investigate the attack patterns behind CVE-2026-18786. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn