What is the CVSS score of CVE-2026-1720?

CVE-2026-1720 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1720?

The WowOptin WordPress plugin contains a critical vulnerability allowing unauthorized users to install arbitrary plugins on affected websites, potentially leading to complete system compromise.

How to fix or mitigate CVE-2026-1720?

Within 24 hours: Disable the WowOptin plugin immediately and audit installed plugins for unauthorized additions. Within 7 days: Deactivate and remove WowOptin entirely, or transition to an alternative popup solution with confirmed security controls. Within 30 days: Implement a WordPress security hardening policy requiring regular plugin audits, capability-based access controls, and Web Application Firewall rules to restrict unauthorized plugin installations.

WordPress CVE-2026-1720

HIGH

Missing Authorization (CWE-862)

2026-03-05 security@wordfence.com

WordPress Authentication Bypass

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 14:16 nvd

HIGH 8.8

DescriptionCVE.org

The WowOptin: Next-Gen Popup Maker - Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'install_and_active_plugin' function in all versions up to, and including, 1.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins.

AnalysisAI

WowOptin: Next-Gen Popup Maker plugin for WordPress versions up to 1.4.24 fails to validate user permissions on plugin installation functions, allowing authenticated subscribers to install and activate arbitrary plugins. This privilege escalation vulnerability enables low-privileged attackers to execute remote code with full WordPress permissions. No patch is currently available.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'install_and_active_plugin' function in all versions up to, and including, 1.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins.

Affected ProductsAI

The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrar