The AutoNetTV Relay WordPress plugin before version 3.0.14 fails to perform any authentication or capability check when it sets a WordPress administrator authentication cookie during a scheduled content‑synchronization task. An unauthenticated attacker can trigger the due scheduled task—if the task executes before the HTTP response is committed—by simply causing the task to run. This allows the attacker to obtain the site’s administrator session cookie and gain full administrator access without ever supplying credentials. The weakness is effectively an improper access control flaw, equivalent to setting privileged credentials without verifying appropriate rights.

Any WordPress installation that uses AutoNetTV Relay plugin prior to version 3.0.14 and has the scheduled sync cron configured to run on the server. The flaw persists on any server arrangement where the cron task runs before the HTTP response is finalized, such as default WordPress cron or custom host cron jobs.

Because the vulnerability requires only that the scheduled task run, an attacker can trigger it remotely by forcing the cron to execute, making the exploit relatively straightforward. The CVSS score is 8.1, and the EPSS score is below 1%, indicating a high severity but a low probability of current exploitation. The CVE is not listed in CISA’s KEV catalog, so there is no evidence of widespread exploitation, but the logical exploitation path remains viable in any relevant environment.