Wagtail CMS CVE-2026-54263

Exploitation requires (1) the attacker to possess a valid Wagtail admin account with at least limited editor permissions - anonymous site visitors cannot exploit this; and (2) a targeted higher-privilege user such as an administrator to actively open the attacker-crafted dynamic image URL, per CVSS UI:R. The vulnerable dynamic image URL generator view in the Wagtail admin is the exact affected feature, and it is reachable on ALL installations regardless of whether the optional dynamic image serve view is enabled. Limiting factors: two-party interaction is mandatory (attacker submission plus victim click), an editor-level credential is a hard prerequisite, and the payload only yields the privileges of whichever user opens the link.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, score 7.3 High) is internally consistent with the description: network-reachable, low attack complexity, but requiring a low-privilege authenticated editor account (PR:L) plus interaction from a higher-privilege victim (UI:R). No EPSS score, KEV listing, or POC was supplied, so real-world exploitation pressure appears low-to-moderate and unconfirmed rather than demonstrated. This is a genuine privilege-escalation vector inside the admin, not an anonymous internet-facing bug - the dual prerequisites (attacker needs an editor account, victim admin must open the crafted link) meaningfully constrain mass exploitation, making it a targeted or insider-leaning risk. Note the C:H/I:H impact metrics are debatable for a reflected XSS bounded to the admin origin; some analysts would rate confidentiality/integrity lower, so treat 7.3 as a reasonable upper-middle estimate rather than a precise figure.

An attacker who holds (or has phished or self-registered) a limited editor account in the Wagtail admin crafts a malicious dynamic-image URL embedding JavaScript and sends it to an administrator, for example via an internal message or a content-review request. When the higher-privilege admin opens the link, the reflected payload executes in their authenticated session and performs admin actions on the attacker's behalf, such as creating a new superuser. No public POC was provided in the source data.