CVE-2026-18786

CVE-2026-18786 in the CheckView plugin exposes a fundamental authentication scoping failure that you need to understand not just as a patch, but as a pattern to recognize in any WordPress plugin audit. The vulnerability: CheckView registers a `rest_authentication_errors` filter that checks whether the request URI contains a specific string, and if it does, it discards all authentication errors. The problem is the check uses loose substring matching (`strpos` or equivalent) rather than scoped route matching. Any request whose URI contains that magic string—regardless of whether it actually hits a CheckView endpoint—bypasses authentication entirely. This transforms the attack surface. You don't need to find a vulnerable CheckView function; you need an admin to open a crafted link containing that string, and their browser session will execute the bypass. Once authenticated as the admin, the attacker can create new admin accounts, install malicious plugins, or inject backdoors. The CVSS 8.8 is warranted—the impact is complete site compromise. The fix is straightforward: replace the substring check with proper route scoping. Use `rest_get_route()` and compare it against the exact endpoints your plugin registers, or verify `get_current_user_id()` before discarding errors. But understand the deeper lesson: the WordPress REST authentication API operates globally by default, and every plugin author must actively resist the insecure path. That's a systemic design problem, not just developer carelessness. For defenders: audit your plugins for this pattern. If you see `rest_authentication_errors` with string matching against the request URI, that's your indicator. The enumeration risk is real—attackers can probe for the magic string to confirm the plugin is installed and vulnerable. Prioritize patching, and treat any admin session compromise as existential given the account-creation privilege escalation this enables.

Reviewed through automated stages and approved by a human before publication.