What is CVE-2026-13600?
The AutoNetTV Relay WordPress plugin before version 3.0.14 fails to perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. This could allow an unauthenticated attacker to obtain an administrator cookie on certain server configurations. Update the plugin to version 3.0.14 or later immediately.
Azərbaycanca: AutoNetTV Relay WordPress plaqini 3.0.14 versiyasından əvvəl planlaşdırılmış kontent sinxronizasiya tapşırığı zamanı heç bir icazə yoxlaması etmir. Bu, autentifikasiya olunmamış hücumçuya WordPress administrator çərəzini ələ keçirməyə imkan verə bilər. Plaqini dərhal ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-306
FAQ2
Which versions of the AutoNetTV Relay plugin are affected by CVE-2026-13600?
All versions of the AutoNetTV Relay WordPress plugin before version 3.0.14 are affected by this vulnerability.
What can an attacker gain by exploiting this vulnerability?
An unauthenticated attacker could obtain a WordPress administrator authentication cookie on certain server configurations.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.