The AutoNetTV Relay WordPress plugin before version 3.0.14 fails to perform any authentication or capability check when it sets a WordPress administrator authentication cookie during a scheduled content‑synchronization task. An unauthenticated attacker can trigger the due scheduled task—if the task executes before the HTTP response is committed—by simply causing the task to run. This allows the attacker to obtain the site’s administrator session cookie and gain full administrator access without ever supplying credentials. The weakness is effectively an improper access control flaw, equivalent to setting privileged credentials without verifying appropriate rights.

Any WordPress installation that uses AutoNetTV Relay plugin prior to version 3.0.14 and has the scheduled sync cron configured to run on the server. The flaw persists on any server arrangement where the cron task runs before the HTTP response is finalized, such as default WordPress cron or custom host cron jobs.

Because the vulnerability requires only that the scheduled task run, an attacker can trigger it remotely if they can cause the cron to execute, making the exploit relatively straightforward. Although no CVSS or EPSS scores are publicly available, the lack of authentication and the potential to obtain an administrator session cookie suggest a high‑severity risk. The CVE is not listed in CISA’s KEV catalog, so there is currently no evidence of widespread exploitation, but the logical exploitation path remains viable in any relevant environment.