CVE-2026-42411: WordPress CloudSecure WP Security plugin <= 1.4.7 - Broken Authentication vulnerability

Synopsis

A broken authentication vulnerability affects the CloudSecure WP Security plugin for WordPress, versions 1.4.7 and earlier. The flaw is reachable over the network without any credentials, though exploitation requires meeting certain environmental conditions due to a high attack complexity rating. Successful exploitation gives an attacker full read, write, and availability impact over the affected system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress instance via HTTP or HTTPS.

• AuthenticationNot required

  No account or credentials of any kind are needed to attempt exploitation; the vulnerability is fully unauthenticated.

• Victim interactionNot required

  The attacker does not need to trick or involve any user to carry out the attack.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account for external factors such as race conditions, specific server state, or other environmental prerequisites that are not fully under their control.

Blast Radius

• A successful attacker reads arbitrary data from the WordPress installation, including stored credentials, session tokens, and private post content.
• The attacker can write or modify data, including creating or altering user accounts, posts, and plugin configuration.
• The attacker can disrupt availability of the WordPress site, causing denial of service to legitimate visitors and administrators.
• Because all three impact dimensions are rated High, a complete compromise of the affected WordPress instance is within scope of a successful exploit.