EUVD-2026-36922
GHSA-65qj-xmm4-g884
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site running iControlWP ≤5.5.3
-
DeliverySend unauthenticated request to vulnerable plugin endpoint
-
ExploitBypass missing capability check (CWE-266)
-
InstallObtain administrator-level privileges
-
C2Upload malicious plugin or webshell
-
ExecuteExecute arbitrary PHP on server
-
ImpactFull site and data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | The target WordPress site must have the iControlWP (worpit-admin-dashboard-plugin) plugin installed and active at version 5.5.3 or earlier, and the vulnerable plugin endpoint must be reachable over the network - typically via the site's public /wp-admin/admin-ajax.php or REST API surface. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special configuration is required beyond having the plugin enabled, so any default deployment of the affected versions is exposed. Limiting factors are narrow: only the install base of this specific plugin is affected, and sites that have already removed or deactivated iControlWP, or that gate /wp-admin behind IP allowlists or a WAF, are not directly exploitable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) signals worst-case remote, unauthenticated, low-complexity exploitation with full CIA impact, which is consistent with WordPress administrator takeover. However, supporting signals are limited: no EPSS score, KEV status, SSVC decision, or POC indicator was provided, and no public exploit has been identified at time of analysis. The vulnerability is not currently in CISA KEV, suggesting no confirmed in-the-wild exploitation yet, but Patchstack-reported WordPress plugin privilege-escalation issues are routinely weaponized within days of disclosure once the patched diff is public, so this should be treated as a real, near-term priority for any site running iControlWP rather than a theoretical high-CVSS finding. |
| Exploit ScenarioDerived | A remote attacker scans the internet for WordPress sites running iControlWP <= 5.5.3 and sends a crafted unauthenticated HTTP request to a vulnerable plugin endpoint that fails to enforce capability checks, causing the plugin to grant the request administrator-level privileges or perform a privileged action on the attacker's behalf. The attacker then uses that access to install a malicious plugin or theme containing a webshell, achieving full site takeover. No public exploit has been identified at time of analysis, but Patchstack-class WordPress privilege-escalation flaws are typically reproduced quickly after disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Unauthenticated privilege escalation in iControlWP WordPress plugin versions 5.5.3 and earlier allows remote attackers to gain elevated privileges on affected WordPress sites without authentication. Reported by Patchstack and rated CVSS 9.8, the flaw maps to CWE-266 (Incorrect Privilege Assignment) and impacts the worpit-admin-dashboard-plugin distribution. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.
RemediationAI
No vendor-released fixed version is independently confirmed in the available data, so consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/worpit-admin-dashboard-plugin/vulnerability/wordpress-icontrolwp-plugin-5-5-3-privilege-escalation-vulnerability for the current patched release and upgrade beyond 5.5.3 as soon as one is published. Until a patched version is installed, deactivate and remove the iControlWP plugin on affected WordPress sites (this disables remote management via the iControlWP dashboard, so operators relying on it must temporarily use direct wp-admin access), or place the site behind a WAF rule that blocks unauthenticated requests to the plugin's admin-ajax.php and REST endpoints (which may break legitimate iControlWP central-dashboard calls). Restricting access to /wp-admin and /wp-json to known IPs is an additional compensating control with the trade-off of breaking remote management from unlisted networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
iControlWP (formerly Worpit Admin Dashboard Plugin) is a WordPress management plugin authored by 'paul' (CPE cpe:2.3:a:paul:icontrolwp) that enables remote administration of WordPress sites from a central dashboard. CWE-266 (Incorrect Privilege Assignment) indicates the plugin assigns privileges to a user or session in a way that does not properly enforce intended access controls - typically due to missing capability checks, flawed nonce/token validation, or incorrect role assignment logic in a privileged AJAX/REST endpoint. Because such management plugins commonly expose endpoints that mediate site control actions, a missing authorization check on one of these endpoints would allow an unauthenticated request to acquire administrator-equivalent capabilities.
Know when Icontrolwp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Plugin endpoint is reachable over the network with no auth or user interaction, and administrator takeover yields full confidentiality, integrity, and availability impact on the WordPress site.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.
Executive ViewAI
A critical vulnerability in iControlWP WordPress plugin (versions 5.5.3 and earlier) enables unauthenticated attackers to escalate privileges and gain full administrative access to affected websites. All WordPress sites using this plugin are exposed to unauthorized account takeover, data breach, and operational compromise. Immediate action is required to protect site integrity.
Pending patch release: Disable iControlWP plugin on all affected WordPress instances immediately; implement Web Application Firewall (WAF) rules to block exploit patterns; restrict administrative interface access via IP whitelisting; enable and monitor WordPress security audit logs for privilege escalation attempts; maintain current backup copies to support rapid recovery if unauthorized access occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Icontrolwp
View allThe iControlWP - Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versi
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Exploit-DB