What is the CVSS score of CVE-2026-65507?

CVE-2026-65507 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of AIWU are affected by CVE-2026-65507?

Organizations deploying the AIWU AI Copilot Content Generator WordPress plugin (versions 1.5.6 and earlier) face immediate risk of complete site compromise through an unauthenticated privilege…

How to fix or mitigate CVE-2026-65507?

Within 24 hours: conduct complete inventory of WordPress instances running AIWU plugin versions 1.5.6 or earlier, and immediately deactivate the plugin on all affected systems. Within 7 days: completely remove the plugin from all environments; review WordPress access logs and admin audit trails for unauthorized administrative account creation or privilege changes since last known-secure state, and restore from backups if suspicious activity is identified. Within 30 days: establish vendor security monitoring and implement governance controls to block plugin installation without security team authorization.

AIWU CVE-2026-65507

EUVD-2026-53963 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-08-06 Patchstack

GHSA-xpch-grqf-pgpq

WordPress Privilege Escalation Wordpress Plugin Aiwu

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description explicitly states unauthenticated privilege escalation, so PR:N and UI:N with network reach; gaining admin-level control yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:25 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.

AnalysisAI

Unauthenticated privilege escalation in the AIWU (AI Copilot Content Generator) WordPress plugin versions 1.5.6 and earlier allows remote attackers with no authentication to gain elevated privileges within the WordPress site. Reported by Patchstack and tracked as EUVD-2026-53963, the flaw carries a CVSS 9.8 rating driven by network-reachable, no-interaction exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

AIWU is a third-party WordPress plugin (slug: ai-copilot-content-generator) authored by the developer identified as 'sergey', designed to generate content via AI. The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns a level of privilege to an actor that is more permissive than intended - typically because a privileged action or role change is exposed through an endpoint that lacks a proper capability or authentication check. The affected CPE is cpe:2.3:a:sergey:aiwu:*:*:*:*:*:*:*:*, covering all released versions up to and including 1.5.6. In WordPress plugins, this class of flaw commonly manifests as an AJAX/REST handler or registration/role-assignment routine reachable by unauthenticated visitors that permits an attacker to escalate to an administrator-equivalent role.

RemediationAI

No vendor-released patch version is identified at time of analysis; the input lists 1.5.6 and earlier as affected but does not name a fixed release. Administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ai-copilot-content-generator/vulnerability/wordpress-aiwu-plugin-1-5-6-privilege-escalation-vulnerability) for any updated version and upgrade immediately if one is published. Until a confirmed fixed version is available, the most reliable compensating control is to deactivate and remove the AIWU plugin, which eliminates the vulnerable code path at the cost of losing the AI content-generation feature. If removal is not acceptable, place the plugin's endpoints behind a WAF/virtual patch (Patchstack offers virtual patching for this entry) and restrict access to wp-admin, admin-ajax.php, and REST routes to trusted IP ranges, accepting that IP allowlisting may break legitimate remote or automated use.