CVE-2026-19718

highCVSS 8.1covered by 1 sourcefirst seen 2026-08-26

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.

⚡ Watch CVE-2026-19718

Get an email if CVE-2026-19718 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-19718: The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin…nvd · 2026-08-26

External references

NVD record for CVE-2026-19718

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-19718 status](https://www.csirts.com/badge/CVE-2026-19718)](https://www.csirts.com/cve/CVE-2026-19718)