The WP Remote WordPress Plugin, Malcare Security, and BlogVault Backup & Staging < 6.65 - Unauthenticated Site Takeover via Brute Force
critical
Multiple plugins for WordPress are vulnerable to unauthenticated site takeover in various versions. This is due to a weak pseudo-random number generator that makes it possible for attackers to brute force and connect to the remote connection feature. This makes it possible for unauthenticated attackers to connect a s...
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 6.65
- Fixed in:
- 6.65
- Disclosed:
- Aug 24, 2026
CVE-2026-19718 on NVD →
BlogVault WordPress Backup Plugin 1.40 - 1.44 - Unauthenticated PHP Object Injection
high
The BlogVault WordPress Backup Plugin for WordPress is vulnerable to PHP Object Injection in versions 1.40 - 1.44 via deserialization of untrusted input in the vulnerable function processApiRequest. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP...
- CVSS:
- 8.3
(Wordfence)
- Affected:
- 1.40 – 1.44
- Fixed in:
- 1.45
- Disclosed:
- Apr 6, 2017
BlogVault WordPress Backup Plugin – Migration, Staging, and Backups [blogvault-real-time-backup] >= 1.40 - <= 1.44
unknown
The BlogVault WordPress Backup Plugin for WordPress is vulnerable to PHP Object Injection in versions 1.40 - 1.44 via deserialization of untrusted input in the vulnerable function processApiRequest. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP...
- Affected:
- 1.40 – 1.44
- Fixed in:
- 1.44
- Disclosed:
- Apr 6, 2017
BlogVault WordPress Backup Plugin – Migration, Staging, and Backups [blogvault-real-time-backup] < 1.06
unknown
This plugin is prone to a admin.php blogVault key setting cross site request forgery vulnerability.
Update the plugin.
- Affected:
- up to 1.06
- Fixed in:
- 1.06
- Disclosed:
- Aug 1, 2014
BlogVault WordPress Backup Plugin – Migration, Staging, and Backups [blogvault-real-time-backup] < 1.0.9
unknown
This plugin is prone to a missing account empty secret key generation vulnerability.
Update the plugin to v1.0.9
- Affected:
- up to 1.0.9
- Fixed in:
- 1.0.9
- Disclosed:
- Aug 1, 2014
BlogVault WordPress Backup Plugin – Migration, Staging, and Backups [blogvault-real-time-backup] >= 1.40 - <= 1.44
unknown
The Backup & Staging – BlogVault Backups WordPress plugin was affected by an Unauthenticated PHP Object Injection security vulnerability.
- Affected:
- 1.40 – 1.44
- Fixed in:
- 1.44
BlogVault WordPress Backup Plugin – Migration, Staging, and Backups [blogvault-real-time-backup] < 1.06
unknown
The Backup & Staging – BlogVault Backups WordPress plugin was affected by an admin.php blogVault Key Setting CSRF security vulnerability.
- Affected:
- up to 1.06
- Fixed in:
- 1.06
BlogVault WordPress Backup Plugin – Migration, Staging, and Backups [blogvault-real-time-backup] < 1.09
unknown
- Affected:
- up to 1.09
- Fixed in:
- 1.09
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database