EUVD-2026-37463Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote privilege escalation in a WordPress plugin yields admin-equivalent control, giving full C/I/A impact at AV:N/AC:L/PR:N/UI:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.
AnalysisAI
Unauthenticated privilege escalation in the Support Board WordPress plugin (versions prior to 3.8.9) allows remote attackers with no credentials to elevate privileges on affected WordPress sites. The flaw was reported by Patchstack and is tied to CWE-266 (Incorrect Privilege Assignment), with a critical CVSS 3.1 base score of 9.8 reflecting network-reachable, low-complexity exploitation. No public exploit identified at time of analysis, but the unauthenticated nature and plugin's customer-support role make this a high-priority patch for any WordPress site running it.
Technical ContextAI
Support Board is a WordPress plugin (vendor: schiocco) used for customer support, live chat, and ticketing on WordPress-powered sites, identified by CPE cpe:2.3:a:schiocco:support_board:*:*:*:*:*:*:*:*. The CWE-266 (Incorrect Privilege Assignment) root cause indicates that the plugin assigns privileges to a user, role, or session in a way that does not properly enforce intended access boundaries - typically a missing capability check, a role-assignment endpoint reachable without authentication, or an AJAX/REST handler that lets an unauthenticated request modify user attributes such as WordPress role or meta. Because WordPress role escalation generally yields administrative control over the site (including plugin/theme upload and arbitrary PHP execution), CWE-266 in this context functions as a stepping stone to full site compromise.
RemediationAI
Vendor-released patch: Support Board 3.8.9 - upgrade the plugin to version 3.8.9 or later via the WordPress plugin manager or by replacing the plugin files, then verify the installed version in Plugins > Installed Plugins. Patchstack advisory at https://patchstack.com/database/wordpress/plugin/supportboard/vulnerability/wordpress-support-board-plugin-3-8-9-privilege-escalation-vulnerability provides the authoritative reference. If immediate patching is not possible, compensating controls include temporarily deactivating the Support Board plugin (side effect: customer chat/ticketing will be unavailable to site visitors), restricting access to /wp-admin/admin-ajax.php and any plugin-specific REST routes (e.g., /wp-json/supportboard/*) via a WAF or web server ACL to known-good sources (side effect: legitimate end-user support interactions from arbitrary IPs will break), and auditing the wp_users and wp_usermeta tables for unexpected administrator accounts or wp_capabilities changes created since the plugin was installed.
More in Support Board
View allThe Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting atta
Unauthenticated attackers can exploit SQL injection in Support Board v3.7.7's AJAX endpoint to fully compromise the appl
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Support Board v3.7.7 that allows unauthenticated attacker
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today