Summary
CVE-2026-19718 is a high-severity authentication weakness affecting the BlogVault Backup & Staging WordPress plugin (along with the related MalCare WordPress Security and WP Remote plugins, which share the same underlying code). The flaw allows an unauthenticated attacker to recover a secret that binds a WordPress site to its remote management service, because that secret is generated using a weak pseudo-random number generator. Recovery of the secret can lead to administrative access on the affected site. The issue carries a CVSS v3.1 base score of 8.1 (High).
Technical details
- Root cause: The secret token used to bind a site to BlogVault’s remote management/backup service is derived from a weak pseudo-random number generator, making it predictable or recoverable rather than cryptographically secure.
- Trigger condition: An unauthenticated user is able to obtain data derived from this secret through normal plugin functionality, without needing valid credentials.
- Attack vector: Network-based (AV:N); no privileges or user interaction are required, though the attack complexity is rated High (AC:H), indicating some non-trivial effort or precondition to recover the weak secret.
- Impact: Successful recovery of the secret can allow an attacker to impersonate the remote management service and gain administrative access to the WordPress site, resulting in high impact to confidentiality, integrity, and availability.
Affected software
- BlogVault Backup & Staging WordPress Plugin: versions 5.16 to less than 6.65
- MalCare WordPress Security Plugin: versions 5.16 to less than 6.65
- WP Remote WordPress Plugin: versions 5.16 to less than 6.65
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Update the BlogVault Backup & Staging plugin (and MalCare or WP Remote, if installed) to version 6.65 or later, where the weak secret generation has been remediated.
- If patching is not immediately possible: Restrict or monitor access to the plugin’s remote-management endpoints where feasible, and rotate any site-binding secrets/API credentials associated with these plugins after upgrading to prevent continued use of a previously exposed or predictable secret.
How IONIX identifies potentially affected assets
IONIX matches the following signal against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw response body:
/wp-content/plugins/blogvault-real-time-backup/

