CVE-2026-18960
Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords
MEDIUM 5.4EPSS 0.3%
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
- Affected
- Block User Account
- CVSS v3.1 CNA
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - EPSS
- 0.28% chance of exploitation in the next 30 days, 20th percentile
- Published
- 2026-08-10
- Updated
- 2026-08-11