What is the CVSS score of CVE-2026-48879?

CVE-2026-48879 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-48879?

Within 24 hours: Audit all WordPress installations to identify systems running AIWU version 1.4.17 or earlier using WordPress admin dashboard or WP-CLI. Within 7 days: Deactivate and remove the AIWU plugin entirely from all affected sites; verify site functionality post-removal. Within 30 days: Review WordPress access logs for signs of prior exploitation; establish monitoring for vendor patch release; evaluate and deploy alternative plugins from vendors with demonstrated security practices.

AIWU WordPress Plugin CVE-2026-48879

EUVD-2026-33649 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-06-01 audit@patchstack.com

GHSA-pfx8-r844-mqr9

WordPress Privilege Escalation Wordpress Plugin

9.8

CVSS 3.1 · Vendor: patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Fingerprint WordPress site running AIWU ≤1.4.17
Delivery

Send crafted unauthenticated HTTP request to vulnerable plugin endpoint
Exploit

Trigger incorrect privilege assignment (CWE-266)
Install

Obtain administrator-level WordPress capabilities
C2

Upload malicious plugin or theme containing PHP webshell
Execute

Execute arbitrary code as web server user
Impact

Maintain persistence and pivot to site data

Vulnerability Assessment

Weakness	CWE CWE-266 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Privilege assignment review
Exploitation Conditions	The only confirmed prerequisite is that the target WordPress site has the AIWU (ai-copilot-content-generator) plugin installed and activated at a version at or below 1.4.17, and that the vulnerable endpoint is reachable over the network - consistent with CVSS AV:N/AC:L/PR:N/UI:N (no authentication, no user interaction, no special configuration required). The advisory does not call out a non-default setting or feature toggle as a precondition, so default installations should be assumed exploitable. Realistic limiting factors are deployment-level rather than vulnerability-level: sites behind authentication-required reverse proxies, IP-allowlisted admin interfaces, or WAFs with WordPress rule sets may not be reachable by anonymous attackers.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) signals worst-case exploitability - remote, low-complexity, no privileges, no user interaction, with full confidentiality, integrity, and availability impact on the affected WordPress instance. EPSS data was not supplied with this CVE record, KEV status is not listed, and no POC has been published at time of analysis, so real-world exploitation telemetry is currently limited. Despite the absence of KEV/EPSS signals, WordPress plugin privilege-escalation bugs of this class historically attract opportunistic mass-scanning within days of disclosure, so the practical risk to internet-facing sites should be treated as high rather than theoretical. The CVSS rating and description are mutually consistent (network vector aligns with WordPress plugins serving HTTP endpoints), so no conflicts between data sources were observed.
Exploit ScenarioDerived	An unauthenticated attacker discovers a WordPress site running AIWU 1.4.17 or earlier via fingerprinting (e.g., readme.txt or plugin asset paths), then sends a crafted HTTP request to a vulnerable plugin endpoint that triggers the incorrect privilege assignment, causing their session or a newly created account to be granted administrator-level capabilities. With administrator access, the attacker uploads a malicious plugin or theme containing a PHP webshell, achieving full site takeover and code execution within the web server context.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 01, 2026

Privilege escalation in the AIWU (AI Copilot Content Generator) WordPress plugin by Sergey, affecting all versions up to and including 1.4.17, allows remote unauthenticated attackers to gain elevated privileges on a target WordPress site. The CVSS 9.8 score with AV:N/PR:N indicates no authentication is required and the attack can be carried out over the network against any site running a vulnerable installation. No public exploit identified at time of analysis, but the Patchstack reference indicates this was identified through their managed audit program for WordPress plugins.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory lists the vulnerable range as 'n/a through 1.4.17' without naming a fixed version, so administrators should treat all currently published builds as vulnerable until a 1.4.18 (or later) release is confirmed at https://patchstack.com/database/wordpress/plugin/ai-copilot-content-generator/vulnerability/wordpress-aiwu-plugin-1-4-17-privilege-escalation-vulnerability. The most reliable compensating control is to deactivate and remove the AIWU plugin until a fixed version is published, which will eliminate the attack surface entirely at the cost of losing the AI content-generation feature. If the plugin must remain installed, restrict access to /wp-admin and the WordPress REST/AJAX endpoints (admin-ajax.php, wp-json/) via web-application firewall rules or IP allowlisting and audit the wp_users and wp_usermeta tables for unexpected administrator accounts or role grants; these controls reduce exposure but do not patch the underlying flaw and may break legitimate plugin functionality for non-allowlisted users.

Affected VersionsENISA

AIWU n/a ≤1.4.17

Affected Packages

euvd aiwu no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

AIWU is a WordPress plugin marketed as an AI-driven content generator (registered in the Patchstack database under the slug 'ai-copilot-content-generator'). The root cause is classified as CWE-266 (Incorrect Privilege Assignment), which occurs when a product assigns a user or process a privilege that is greater than what is intended for their role. In the WordPress plugin context, this class of bug typically manifests when a plugin endpoint or capability check assigns elevated roles (e.g., administrator) to users based on attacker-controllable input, missing capability checks on AJAX/REST handlers, or insecure user-meta updates that bypass WordPress's role/capability API.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (patchstack) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (patchstack) · only source for this CVE.

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation.

This issue affects AIWU: from n/a through 1.4.17.

Executive ViewAI

Why It Matters

The AIWU (AI Copilot Content Generator) WordPress plugin contains an unauthenticated privilege escalation vulnerability affecting all versions through 1.4.17, allowing remote attackers to gain administrative control of WordPress sites without credentials. Any organization running this plugin faces immediate risk of complete site compromise, including unauthorized content modification, data theft, and malware injection. With no patch currently available, immediate removal of the plugin is the only reliable remediation.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately remove the plugin from all sites; (2) Deploy Web Application Firewall rules to block privilege escalation payloads if immediate removal is not feasible; (3) Restrict WordPress administrative interfaces to known IP ranges via VPN or allowlisting; (4) Enable enhanced logging on all WordPress administrative accounts; (5) Deploy WordPress security plugin with real-time malware scanning and file integrity monitoring.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.