{"id":"CVE-2026-18960","aliases":["EUVD-2026-55011","GHSA-c64r-rhpr-pqr5"],"status":"published","title":"Block User Account \u003c 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords","description":"The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00283,"percentile":0.21042,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-08-10T06:00:16Z","modified":"2026-08-26T16:30:52Z","products":[{"vendor":"unknown","product":"block user account"}],"references":[{"url":"https://wpscan.com/vulnerability/c80abded-9f0e-4e44-8c8a-b0d1bc1b16d0/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18960"},{"url":"https://wpscan.com/vulnerability/c80abded-9f0e-4e44-8c8a-b0d1bc1b16d0"},{"url":"https://github.com/advisories/GHSA-c64r-rhpr-pqr5"}],"sources":{"cve":[{"id":"CVE-2026-18960","title":"Block User Account \u003c 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords","description":"The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.","status":"published","published":"2026-08-10T06:00:16.926Z","modified":"2026-08-11T20:41:33.168Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-55011","description":"The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.","status":"published","published":"2026-08-10T06:00:16Z","modified":"2026-08-11T20:41:33Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:59.11112Z"}],"ghsa":[{"id":"GHSA-c64r-rhpr-pqr5","title":"The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every...","description":"The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.","status":"published","published":"2026-08-10T09:31:22Z","modified":"2026-08-11T21:33:35Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:10:22.198935Z"}],"nvd":[{"id":"CVE-2026-18960","description":"The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.","status":"published","published":"2026-08-10T07:16:50.83Z","modified":"2026-08-26T16:30:52.723Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:35.743275Z"}]}}