Authentication Bypass in Vulnity Security Plugin for WordPress

The Vulnity Security plugin for WordPress (versions 1.4.3 and earlier) is susceptible to an authentication bypass vulnerability. The flaw exists on Nginx-based web server installations where the plugin generates a configuration snippet to secure the delegated-login pairing credential file. Due to an incorrect directory path in the server configuration, the credential file remains accessible to unauthorized users. An attacker can exploit this misconfiguration to retrieve the sensitive credentials, forge signed REST API requests, and authenticate as an administrative user. This vulnerability impacts the security of any WordPress installation utilizing the plugin's delegated-login feature on Nginx, potentially leading to a full site takeover.

Impact

Successful exploitation allows an unauthenticated remote attacker to gain administrative access to the affected WordPress installation. This enables the attacker to modify site content, install malicious plugins, exfiltrate database information, or pivot further into the underlying hosting infrastructure. As the vulnerability resides in a commonly used security-focused plugin, it poses a significant risk to the integrity and confidentiality of targeted WordPress deployments.

Recommendation

• Immediately update the Vulnity Security plugin to a version addressing CVE-2026-75903.
• Audit Nginx configuration files on WordPress servers for any directives granting read access to the directory containing the plugin's delegated-login pairing credential file.
• Implement access control restrictions in the Nginx configuration to deny all external requests to the identified credential storage path.