CVE-2026-18960

The CVE-2026-18960 patch (2.0.1) addresses a flaw in the WordPress application passwords plugin that goes beyond a simple missing authorization check. The vulnerability stems from the plugin evaluating user block status at the time an application password is created, embedding that decision into the credential itself, and never re-evaluating it during authentication. This is a persistent authorization cache—security state frozen at credential creation and trusted indefinitely. What this means in practice: if you blocked a user after they had already created an application password, that password remains valid post-block. The block is only enforced for passwords created after the fix. This transforms the remediation question from 'did the developer forget a check?' to 'does the authentication architecture allow security state to become stale?' The CVSS 5.4 rating warrants scrutiny. Application passwords grant access at the user's full role level—a blocked administrator retains full REST API access to posts, users, themes, and options through a stale credential. The score reflects the narrow trigger condition (pre-existing password) rather than the operational severity if a blocked admin's credentials persist. For defenders, the critical question is whether 2.0.1 invalidates existing application passwords or only adds runtime checks. If existing passwords remain valid, blocked users with prior credentials retain access. Audit your installation for application passwords belonging to accounts that were subsequently blocked or demoted—these represent active authorization bypasses. The patch may have corrected the creation-time check but left existing credentials untouched, creating an operational gap that requires manual credential revocation.

Reviewed through automated stages and approved by a human before publication.