What is the CVSS score of CVE-2026-57692?

CVE-2026-57692 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PrivateContent are affected by CVE-2026-57692?

The LCweb PrivateContent WordPress plugin (all versions through 9.9.2) contains a critical privilege escalation vulnerability (CVE-2026-57692, CVSS 9.8) that allows unauthenticated attackers to gain…

How to fix or mitigate CVE-2026-57692?

Within 24 hours: Identify all WordPress instances running LCweb PrivateContent v9.9.2 or earlier and document in your asset inventory. Within 7 days: Disable the plugin across all affected instances unless it is operationally critical; if critical, implement emergency network controls (WAF rules or IP restrictions) to limit unauthenticated access to plugin endpoints. Within 30 days: Monitor Patchstack security advisories for patch availability; evaluate alternative content protection plugins; once a patched version is released, deploy and test thoroughly before re-enabling in production.

PrivateContent CVE-2026-57692

EUVD-2026-40991 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-07-01 Patchstack

GHSA-vwc9-859w-9p44

WordPress Privilege Escalation Privatecontent Wordpress Plugin Lcweb

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable with low complexity, but 'privilege escalation' typically presupposes an existing low-privilege account, so PR:L rather than the vendor's PR:N; full CIA impact retained.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:20 vuln.today

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation.

This issue affects PrivateContent: from n/a through 9.9.2.

AnalysisAI

Privilege escalation in the LCweb PrivateContent WordPress plugin (all versions up to and including 9.9.2) lets attackers obtain permissions beyond those intended, driven by an incorrect privilege assignment flaw (CWE-266). The Patchstack-assigned CVSS of 9.8 (network, no privileges, no user interaction) implies an attacker could gain administrator-level control over a WordPress site's protected content and settings. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PrivateContent is a WordPress plugin (CPE cpe:2.3:a:lcweb:privatecontent) used to gate site content behind user accounts, membership levels, and access rules. The root cause is CWE-266 Incorrect Privilege Assignment: the plugin assigns a privilege, role, or access level to a user or request context that it should not have, so an actor ends up with rights the developer never intended to grant. In WordPress plugins this class typically manifests as a registration/profile/role-handling routine that trusts client-supplied role or capability values, or a membership-tier check that fails to bind privileges to the correct account, allowing escalation to a higher membership level or WordPress role.

RemediationAI

No vendor-released patch version was identified in the provided data; the advisory only marks 9.9.2 as the last affected version, so administrators should upgrade to the next release published after 9.9.2 once confirmed on the WordPress plugin page or via Patchstack, and verify the exact fixed version there before relying on it. Until a fixed version is confirmed and applied, apply compensating controls: deactivate the PrivateContent plugin if the content-gating feature is not business-critical (trade-off: protected content becomes inaccessible/unpublished), disable open user self-registration in WordPress settings to remove the likely account-creation path (trade-off: legitimate self-service signup is blocked), and place the site behind a WAF/virtual-patching service such as Patchstack that ships a rule for this CVE (trade-off: rule coverage and potential false positives). Consult the Patchstack advisory for fix details: https://patchstack.com/database/wordpress/plugin/private-content/vulnerability/wordpress-privatecontent-plugin-9-9-2-privilege-escalation-vulnerability?_s_id=cve.