AIWU CVE-2026-65507

The CVE description gives no configuration or feature prerequisite beyond running an affected version, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions - remote unauthenticated exploitation against default installations of the AIWU plugin version 1.5.6 or earlier. The primary limiting factor is deployment: the target site must have the AIWU (ai-copilot-content-generator) plugin installed and active. The specific vulnerable endpoint, parameter, or role-assignment routine is not disclosed in the available data, so the exact triggering request cannot be confirmed from this input.

The signals partially align toward high priority but contain important gaps. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates trivial remote, unauthenticated exploitation with full impact, and the CWE-266 classification is consistent with a genuine privilege-escalation primitive. However, no EPSS score, SSVC decision, KEV status, or POC availability was supplied, so exploitation probability cannot be quantified from the input - no public exploit identified at time of analysis. The description is extremely terse ('Unauthenticated Privilege Escalation in AIWU <= 1.5.6') and does not name the specific vulnerable endpoint or condition, so while the CVSS numbers argue for urgency, the real-world threat is bounded chiefly by the plugin's likely small deployment footprint rather than by exploitation difficulty. Net: high technical severity for sites running the plugin, but likely limited overall exposure given prevalence.

A remote attacker sends a crafted unauthenticated request directly to a vulnerable AIWU endpoint on a target WordPress site and, because the plugin assigns privileges without a proper capability or authentication check, obtains an elevated (likely administrator-level) role or performs a privileged action. From there the attacker can install malicious plugins, create rogue admin accounts, and fully compromise the site. No public exploit is identified at time of analysis, but the low attack complexity means weaponization would be straightforward if the vulnerable endpoint is known.