Amentotech Taskbot CVE-2026-39753

The target must be a WordPress installation with the Amentotech Taskbot plugin installed and activated at version 6.6 or earlier; the vulnerable privilege-assignment logic is reachable in the plugin's default state. Per the CVSS vector (PR:N/UI:N/AC:L) and the 'Unauthenticated' description, no credentials, no victim interaction, and no special non-default configuration are required - remote unauthenticated exploitation works against a standard install. The principal limiting factor is deployment scope: exploitation is confined to sites running this specific, relatively uncommon plugin, so exposure depends entirely on the plugin being present rather than on any additional precondition.

All provided signals point to a high-severity, high-priority flaw, though confidence is tempered by sparse corroborating intelligence. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vulnerability yielding full C:H/I:H/A:H impact - consistent with the 'Unauthenticated Privilege Escalation' description and CWE-266 (Incorrect Privilege Assignment), where an attacker gains administrator-level WordPress access without credentials. No EPSS score, SSVC decision, KEV listing, or POC reference was supplied, so exploitation likelihood cannot be quantified from the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of EPSS/KEV data does not lower the intrinsic severity - a full-admin takeover primitive in a WordPress plugin is highly attractive and such flaws are frequently weaponized quickly once disclosed - but it does mean the 'real-world exploitation probability' leg of the assessment is unknown rather than low. Net: a genuine priority for anyone running the affected plugin, driven by the unauthenticated-to-admin impact, with the caveat that exploitation telemetry (EPSS/KEV/POC) is missing and the underlying product is niche, limiting aggregate blast radius.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Taskbot plugin (version 6.6 or earlier), abusing an improperly protected privilege-assignment function to grant themselves administrator-level access. With admin rights, they install a malicious plugin or PHP webshell to achieve full remote code execution and site takeover. No public exploit code was identified in the provided data; the low attack complexity (AC:L) and lack of required privileges or user interaction make exploitation straightforward once a working request is constructed.