EUVD-2026-40991
GHSA-vwc9-859w-9p44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running PrivateContent ≤9.9.2
-
DeliverySend crafted role/privilege request
-
ExploitTrigger incorrect privilege assignment
-
ExecutionObtain elevated role/access
-
ImpactAccess protected content and admin functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | The target must be a WordPress site with the LCweb PrivateContent plugin installed and active at version 9.9.2 or earlier. Beyond that, the provided data supplies no explicit configuration precondition; the CVSS vector states AV:N/AC:L/PR:N/UI:N, implying no authentication or user interaction against a default install. However, the 'privilege escalation' characterization commonly implies an existing low-privilege/member account as the starting point, and authentication requirements are not confirmed from the available data - the description does not name the exact feature or endpoint involved, so the real limiting factor (unauthenticated vs. requires a registered user) should be confirmed against the Patchstack advisory before final risk sign-off. |
| Impact | The signals are partly aligned and partly missing. The vendor (Patchstack) CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8 and describes trivial, remote, unauthenticated exploitation with full CIA impact - very high on paper. However, no EPSS score, no SSVC decision, and no KEV or POC data were provided, so real-world exploitation likelihood cannot be quantified and there is no public exploit identified at time of analysis. Note a tension worth verifying: the flaw is characterized as 'privilege escalation,' which usually presupposes some existing (even low-tier) account, yet the vector states PR:N (no privileges). If exploitation actually requires an authenticated low-privilege user, real-world risk is lower than the 9.8 suggests - verify the exact precondition with the Patchstack advisory. Absent EPSS/KEV, treat this as a high-CVSS issue whose true urgency depends on that authentication precondition and on how widely the plugin is deployed. |
| Exploit ScenarioDerived | An attacker sends a crafted request to a WordPress site running PrivateContent 9.9.2 or earlier that manipulates the plugin's role/privilege assignment, causing the plugin to grant the attacker a higher access level than intended and exposing gated content or administrative capabilities. Given the AC:L vector this requires no special timing or conditions, though whether an initial low-privilege account is needed should be verified. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Privilege escalation in the LCweb PrivateContent WordPress plugin (all versions up to and including 9.9.2) lets attackers obtain permissions beyond those intended, driven by an incorrect privilege assignment flaw (CWE-266). The Patchstack-assigned CVSS of 9.8 (network, no privileges, no user interaction) implies an attacker could gain administrator-level control over a WordPress site's protected content and settings. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
No vendor-released patch version was identified in the provided data; the advisory only marks 9.9.2 as the last affected version, so administrators should upgrade to the next release published after 9.9.2 once confirmed on the WordPress plugin page or via Patchstack, and verify the exact fixed version there before relying on it. Until a fixed version is confirmed and applied, apply compensating controls: deactivate the PrivateContent plugin if the content-gating feature is not business-critical (trade-off: protected content becomes inaccessible/unpublished), disable open user self-registration in WordPress settings to remove the likely account-creation path (trade-off: legitimate self-service signup is blocked), and place the site behind a WAF/virtual-patching service such as Patchstack that ships a rule for this CVE (trade-off: rule coverage and potential false positives). Consult the Patchstack advisory for fix details: https://patchstack.com/database/wordpress/plugin/private-content/vulnerability/wordpress-privatecontent-plugin-9-9-2-privilege-escalation-vulnerability?_s_id=cve.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PrivateContent is a WordPress plugin (CPE cpe:2.3:a:lcweb:privatecontent) used to gate site content behind user accounts, membership levels, and access rules. The root cause is CWE-266 Incorrect Privilege Assignment: the plugin assigns a privilege, role, or access level to a user or request context that it should not have, so an actor ends up with rights the developer never intended to grant. In WordPress plugins this class typically manifests as a registration/profile/role-handling routine that trusts client-supplied role or capability values, or a membership-tier check that fails to bind privileges to the correct account, allowing escalation to a higher membership level or WordPress role.
Know when Privatecontent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable with low complexity, but 'privilege escalation' typically presupposes an existing low-privilege account, so PR:L rather than the vendor's PR:N; full CIA impact retained.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation.
This issue affects PrivateContent: from n/a through 9.9.2.
Executive ViewAI
The LCweb PrivateContent WordPress plugin (all versions through 9.9.2) contains a critical privilege escalation vulnerability (CVE-2026-57692, CVSS 9.8) that allows unauthenticated attackers to gain administrator-level access to WordPress sites using this plugin. Any organization relying on this plugin for content access control is exposed to immediate and complete compromise without authentication; adversaries could modify site settings, expose protected content, and establish persistent administrative access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the plugin immediately if operationally feasible; (2) If plugin is critical to operations, deploy WAF rules or IP-based access controls to restrict unauthenticated requests to the affected plugin; (3) Implement continuous monitoring for unauthorized administrator account creation and privilege escalation activity; (4) Maintain and test current WordPress database backups to enable rapid recovery in the event of compromise detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB