CVE-2026-19718

BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery

State: Published
Severity: 8.1 High
Published: Aug 26, 2026
Updated: Aug 26, 2026
Reserved: Aug 13, 2026

Description

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
BlogVault Backup & StagingUnknown	5.16 to before 6.65Affected
MalCare WordPress Security PluginUnknown	5.16 to before 6.65Affected
The WP Remote WordPress PluginUnknown	5.16 to before 6.65Affected

References

https://wpscan.com/vulnerability/68892d43-912d-421f-9376-8dc6e2e906bc/exploitvdb-entrytechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.