CVE-2026-18216

This vulnerability represents a documented but recurring failure mode in WordPress backup and migration plugins: the post-restore auto-login feature solves a real UX problem (restoring a backup invalidates your session, leaving you locked out) but was designed without accounting for the multisite trust boundary. In a multisite network, the plugin issued session tokens across what WordPress considers separate administrative domains — a subtle scope failure that becomes a session-hijacking vector once an attacker holds admin privileges on any single site in the network. The critical detail is the 2FA bypass. Administrators who enabled two-factor authentication did so because they understood credential theft as the primary threat vector. This plugin silently created authenticated sessions that bypass whatever secondary verification the site had configured. Users believed they controlled their own session lifecycle; this plugin inserted itself into that lifecycle without disclosure or UI indication. That's not just a supply-chain trust failure — it's an epistemic violation against admins who made explicit security decisions based on a model this plugin quietly broke. The exploit requires admin-level access to one site in the multisite network. That sounds like a high bar, but the attack surface is broader than it appears: the vulnerability presupposes nothing anomalous. The exploit IS the legitimate administrative state. There's no spike in unusual logins to detect, no SIEM rule that fires. The CVE-to-fix lag is your only signal, and a MEDIUM CVSS score gives organizational risk calculus permission to deprioritize. Check whether your patch invalidates existing sessions. A fix that scopes tokens to sites is necessary but insufficient if long-lived tokens from the vulnerable version persist in your environment with unknown scope. If the patch doesn't actively invalidate prior sessions, treat this as a potential ongoing compromise until all administrators in your multisite network re-authenticate. Beyond this specific plugin, recognize that this is a class-level failure in the WordPress plugin ecosystem. Multiple backup and migration plugins have重复 this exact mistake — each solving the same restore-time UX pain without visibility into the CVE history of their peers. The plugin repository has no mechanism to propagate lessons from one vulnerability to developers working on the next plugin in the same category. Treat every backup plugin's auto-login feature as a multisite risk until proven otherwise.

Reviewed through automated stages and approved by a human before publication.