← CVE Intelligence

CVE-2026-18960

Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords PUBLISHED

Description (CNA)

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.

Affected (CNA)

Vendor / productVersions
Unknown / Block User Accountaffected 0 before 2.0.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.