WordPress Plugin Authentication Bypass via Weak Secret Generation

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-19718 affects three widely-deployed WordPress plugins—BlogVault Backup & Staging, MalCare WordPress Security, and WP Remote—exposing a critical authentication weakness. The vulnerability stems from two compounding flaws: the plugins generate site binding secrets using a weak pseudo-random number generator, and they fail to restrict unauthenticated access to data derived from these secrets. This allows attackers to obtain exposed secret material, reverse-engineer the weak RNG output, and recover the full administrative binding secret. Anyone using these plugins before version 6.65 faces immediate risk of complete site compromise, as attackers gain administrative access without valid credentials. The impact is severe for WordPress administrators, agencies managing multiple sites, and backup service users who rely on these plugins for security and data protection.

Casky's 283 matched skills leverage Claude's extended reasoning to identify the attack patterns mapped to MITRE techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe detection signals including: attempts to access unauthenticated management endpoints that expose secret derivation data (TA0006 reconnaissance activity), exploitation of weak RNG patterns to predict or brute-force authentication tokens, and subsequent privilege escalation to administrative roles without standard authentication workflows (TA0004). The platform's skills would flag anomalous requests to plugin-specific endpoints, cryptographic weakness indicators in secret generation timing patterns, and unauthorized administrative session creation—allowing security teams to catch exploitation attempts before attackers establish persistent administrative access to their WordPress infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-19718.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-19718

Casky has 283 skills that investigate the attack patterns behind CVE-2026-19718. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn