AIWU WordPress Plugin CVE-2026-39801

The site must be running the AIWU (ai-copilot-content-generator) WordPress plugin at version 1.5.9 or earlier. Based on the 'Subscriber Privilege Escalation' classification and CWE-266 (Incorrect Privilege Assignment), the attacker needs an authenticated Subscriber-level account; this is the key limiting factor and is only trivially met if the WordPress site has open user self-registration enabled (the default 'Anyone can register' option). If registration is closed, the attacker must first obtain or be granted a Subscriber account, substantially raising the bar. Note the unresolved conflict: the input CVSS vector lists PR:N (unauthenticated), which contradicts the Subscriber requirement - verify against the Patchstack advisory before treating this as fully unauthenticated.

The NVD-style CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N) frames this as a remotely exploitable, unauthenticated, low-complexity flaw with total confidentiality, integrity, and availability impact. However, there is a direct conflict between that vector and the vulnerability's own classification: the title states 'Subscriber Privilege Escalation' and the CWE is CWE-266 (Incorrect Privilege Assignment), both of which imply an attacker must already hold an authenticated low-privilege (Subscriber) account - which would be PR:L, not PR:N. This discrepancy should be verified with the Patchstack advisory; if a Subscriber account is genuinely required, the realistic score drops to roughly 8.8 and exploitation depends on whether the WordPress site permits user self-registration. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a serious privilege-escalation bug worth prompt patching for sites running this plugin, but the raw 9.8 likely overstates the barrier to entry, and the absence of exploitation signals means this is not a confirmed in-the-wild priority - prioritize based on whether open registration is enabled.

An attacker registers (or already holds) a low-privilege Subscriber account on a WordPress site running AIWU <= 1.5.9, then abuses the plugin's incorrect privilege assignment to elevate their role to Administrator. From there they control the site - installing malicious plugins, exfiltrating data, or defacing content. No public exploit code was identified at time of analysis, and successful exploitation presupposes the ability to obtain a Subscriber account.