WordPress Core CVE-2026-114570

Exploitation requires an authenticated account with Contributor-level privileges or higher (PR:L), and the attacker-controlled user DISPLAY NAME is the injection vector, surfaced through the Quick Edit feature on WordPress administrative screens. The payload only executes when a higher-privileged user (Editor/Administrator) subsequently views the affected admin screen. A critical limiting factor explicitly stated by the vendor: the issue 'only affects sites with a large number of users,' which corresponds to the AC:H rating - small single- or few-author sites are effectively not exploitable. This confines real risk to large multi-user WordPress deployments (membership sites, large editorial teams, platforms with open or Contributor-level registration). All versions up to and including 7.0.2 are affected; 7.0.3 remediates it.

This is a genuine-but-low-priority vulnerability, not a high-CVSS-with-hidden-risk case - the inputs largely agree on modest real-world risk. The CVSS 3.1 base score is only 4.9 (Medium), and the vector itself tempers the network reachability: AV:N but AC:H and PR:L mean an attacker must already hold a Contributor-level (or higher) account AND the attack conditions must be favorable. The description's qualifier that the issue 'only affects sites with a large number of users' aligns with and justifies the AC:H (High attack complexity) rating. S:C (scope change) and the C:L/I:L impacts reflect that injected script runs in a higher-privileged admin's authenticated session rather than directly compromising the server. No EPSS score was supplied, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code was provided in the sources, so there is no evidence of active exploitation or weaponization. The practical risk is therefore bounded by two gates: attacker needs an authenticated Contributor account, and the target site must have many users for the condition to trigger. For most defenders this is a routine patch-in-next-cycle item; it rises in priority only for multi-author/multi-user WordPress sites (large publishing platforms, membership sites) that grant Contributor accounts to semi-trusted or self-registered users.

On a large multi-author WordPress site, an attacker who holds (or self-registers for) a Contributor-level account sets a malicious display name containing a script payload. When an Editor or Administrator later opens an admin screen that renders that display name through the Quick Edit interface, the insufficiently escaped name executes JavaScript in the admin's authenticated session, enabling actions such as creating a rogue admin or stealing session context. No public exploit code was identified at time of analysis, and the high attack complexity means the payload only reliably surfaces on sites with a large number of users.