TI-2026-15997 Aliases CVE-2026-19718 GHSA-63pv-w3j7-r654

BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery

LOW 37CWE-287Published 2026-08-26 · Updated 2026-08-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.

Summary

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00383 32nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed BlogVault Backup & Staging (Unknown): 6.65MalCare WordPress Security Plugin (Unknown): 6.65+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	BlogVault Backup & Staging	5.16 to before 6.65	6.65	Patch available	CNA
Unknown	MalCare WordPress Security Plugin	5.16 to before 6.65	6.65	Patch available	CNA
Unknown	The WP Remote WordPress Plugin	5.16 to before 6.65	6.65	Patch available	CNA

BlogVault Backup & Staging VendorUnknown Affected 5.16 to before 6.65 Fixed in 6.65 Patch available CNA
MalCare WordPress Security Plugin VendorUnknown Affected 5.16 to before 6.65 Fixed in 6.65 Patch available CNA
The WP Remote WordPress Plugin VendorUnknown Affected 5.16 to before 6.65 Fixed in 6.65 Patch available CNA

Remediation

Fix · CNA BlogVault Backup & Staging (Unknown) Fixed in 6.65
Fix · CNA MalCare WordPress Security Plugin (Unknown) Fixed in 6.65
Fix · CNA The WP Remote WordPress Plugin (Unknown) Fixed in 6.65

Timeline

2026-10-02 Threatist record created from CVE-2026-19718
2026-10-03 Alias added: GHSA-63pv-w3j7-r654

References

Exploit 1

https://wpscan.com/vulnerability/68892d43-912d-421f-9376-8dc6e2e906bc/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences