WordPress MalCare Security Plugin 5.16-6.62 is vulnerable to a high priority Broken Authentication<\/p>
Software: MalCare Security<\/p>
Fixed in version 6.65 <\/p>
Affected Version 5.16-6.62<\/p>
CVE: CVE-2026-19718<\/p>","date":"2026-08-26"},{"id":"f9a889cfb8110339cffea6f24942b163d69a28c1","name":"The WP Remote WordPress Plugin, Malcare Security, and BlogVault Backup & Staging < 6.65 - Unauthenticated Site Takeover via Brute Force","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/the-wp-remote-wordpress-plugin-malcare-security-and-blogvault-backup-staging-665-unauthenticated-site-takeover-via-brute-force","description":"Multiple plugins for WordPress are vulnerable to unauthenticated site takeover in various versions. This is due to a weak pseudo-random number generator that makes it possible for attackers to brute force and connect to the remote connection feature. This makes it possible for unauthenticated attackers to connect a site to their remote management software and take it over.","date":null}],"impact":{"cwe":[{"cwe":"CWE-287","name":"Improper Authentication","description":"When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"5c7f76f56614738668266af7423e3104473c51b972a7f8a19b90b5099a3e8fe3","name":"MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall [malcare-security] < 6.72","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.72","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-84776","name":"CVE-2026-84776","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-84776","description":"[en] Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.","date":"2026-09-03"},{"id":"af00eb98854bb99a45de3978299eda8d24d2509a","name":"MalCare WordPress Security Plugin \u2013 Malware Scanner, Cleaner, Security Firewall <= 6.69 - Unauthenticated Denial of Service","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/malcare-security\/malcare-wordpress-security-plugin-malware-scanner-cleaner-security-firewall-669-unauthenticated-denial-of-service","description":"The MalCare WordPress Security Plugin \u2013 Malware Scanner, Cleaner, Security Firewall plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 6.69. This is due to insufficient validation of user supplied input. This makes it possible for unauthenticated attackers to make the affected site unavailable.","date":"2026-08-24"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"n","a":"h","score":"7.5","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:H","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"none","i":"none","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1789024854"}