CVE-2026-19718highCWE-287

CVE-2026-19718: fallo de gravedad alta en BlogVault Backup & Staging

BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery

Publicada el

Seguir esta CVE+ Monitorear BlogVault Backup & Staging+ Monitorear MalCare WordPress Security Plugin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 8.1epss 0.4%
The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Unknown · BlogVault Backup & StagingUnknown · MalCare WordPress Security PluginUnknown · The WP Remote WordPress Plugin
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.