CVE-2026-13600
Last modified
CVE-2026-13600 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | AutoNetTV Relay | < 3.0.14 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-13600?
How severe is CVE-2026-13600?
How do I fix CVE-2026-13600?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-13592A vulnerability was detected in liftoff-sr CIPster up to e8e…7.3
- CVE-2026-13593CSS::Minifier::XS versions before 0.14 for Perl have a memor…6.5
- CVE-2026-13595A flaw was found in the libblkid library of util-linux. Duri…5.3
- CVE-2026-13596The Participants Database WordPress plugin before 2.7.8.4 do…9.1
- CVE-2026-13597The 微信二维码登陆 WordPress plugin through 1.3 does not properly v…9.1
- CVE-2026-1360The BuddyPress plugin for WordPress is vulnerable to Deseria…7.5
- CVE-2026-13601A flaw was found in Yelp due to an overly permissive Content…6.5
- CVE-2026-13602We found a chain of combining multiple weaknesses in the pro…7.7
- CVE-2026-13603The payment integration pretix-oppwa provides support for t…9
- CVE-2026-13604The Pixelavo WordPress plugin before 1.5.4 registers an una…5.3
- CVE-2026-13605The PhotoSwipe WordPress plugin through 4.1.1.1 uses the tit…6.8
- CVE-2026-13609The Frontend Admin by DynamiApps WordPress plugin before 3.2…8.8
Are you affected by CVE-2026-13600?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST