EUVD-2026-89862
GHSA-hcgm-2rc7-5jjp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running SiteSkite <=2.1.8
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitInject code into PHP execution sink
-
ExecutionExecute arbitrary code as web server user
-
ImpactFull WordPress site and host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is a WordPress site running the SiteSkite plugin at version 2.1.8 or earlier with the vulnerable component reachable. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special configuration are required - exploitation works against a default install of the affected plugin. The primary limiting factor is deployment scarcity: SiteSkite is a niche plugin, so the exposed population is small. The advisory does not specify which feature/endpoint is affected, so defenders cannot narrow exposure below 'plugin installed and active.' |
| Impact | This is a genuine high-priority issue on its intrinsic merits. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) describes the worst case: network-reachable, low-complexity, no privileges, no user interaction, with a scope change and full confidentiality/integrity/availability impact - consistent with unauthenticated code injection (CWE-94) yielding RCE. However, several corroborating signals are absent: no EPSS score is provided, the CVE is not listed in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The single Patchstack advisory is the only source, and it does not disclose the vulnerable code path, sink, or the fixed version, so exploitability is asserted rather than demonstrated. The tempering factor is prevalence: SiteSkite is an obscure, low-footprint WordPress plugin, so despite the perfect CVSS score this is unlikely to see mass automated exploitation the way a widely-installed plugin would. Treat as a real must-patch for any site running SiteSkite, but not a widespread ecosystem emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a WordPress site running a vulnerable SiteSkite plugin endpoint, injecting attacker-controlled code into a PHP execution sink. The injected code runs in the web server context, giving arbitrary command execution and full site compromise. No public POC is referenced, so exploitation currently requires the attacker to independently reconstruct the vulnerable request from the advisory or source. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated remote code execution in the SiteSkite WordPress plugin through version 2.1.8 lets any remote attacker run arbitrary code on an affected site with no credentials, no user interaction, and no special configuration required (CVSS 10.0, vector PR:N/UI:N/AC:L, scope changed). The underlying weakness is a CWE-94 code injection flaw, and because the plugin is a niche one, the realistically exposed population is small and exploitation is more likely to be opportunistic scanning than broad mass exploitation. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the intrinsic severity is high - a single successful request can hand an attacker full control of the WordPress installation and its host context.
RemediationAI
No vendor-released patch was identified in the provided intelligence, and no fixed version is stated, so the primary recommendation is to deactivate and completely remove or delete the SiteSkite plugin from all WordPress installations - removal eliminates the attack surface entirely but forfeits whatever functionality the plugin provides, so sites that depend on it must decide between feature loss and unmitigated RCE risk. If the plugin must remain installed temporarily, the compensating controls are: block or heavily restrict access to the plugin's directory and any of its PHP endpoints at the reverse proxy/WAF layer (accepting that the advisory does not disclose the vulnerable endpoint, so the rule set must cover the whole plugin path and will likely produce false positives), and deploy a WordPress-aware virtual patch from a WordPress security vendor that explicitly covers the sitekite plugin (trade-off: protection depends on the WAF signature being current and does not fix the underlying code). Do not rely on authentication, hardening, or disabling specific features as a mitigation, because the vector is PR:N/AC:L and the vulnerable feature is unidentified. Given the CVSS 10.0 score and the scope-changed impact, treat any host that has run the plugin at version 2.1.8 or earlier as potentially compromised: review web server and PHP logs for anomalous requests to the plugin path, and inspect the WordPress installation for unexpected PHP files, modified plugin/theme code, and unrecognized administrative users. Monitor the Patchstack advisory URL (https://patchstack.com/database/wordpress/plugin/siteskite/vulnerability/wordpress-siteskite-plugin-2-1-8-remote-code-execution-rce-vulnerability?_s_id=cve) for a confirmed fixed version before any reinstatement of the plugin, and re-verify the exact version string with the vendor rather than assuming 2.1.9 or any other number.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SiteSkite is a third-party WordPress plugin distributed through the WordPress ecosystem; the affected product is identified by the wildcard CPE cpe:2.3:a:siteskite:siteskite:*:*:*:*:*:*:*:*, meaning every published version is treated as in scope unless a fixed release exists. The root cause class is CWE-94 (Improper Control of Generation of Code / code injection), which in a PHP plugin context typically means attacker-supplied input reaches a code-execution sink such as eval(), create_function(), a dynamically included file, or an unserialize/callback path that ends in execution - the input is not merely reflected or stored, it is turned into executable code. The CVSS vector's scope-changed component (S:C) indicates the vulnerable component can affect resources beyond its own security authority, consistent with plugin-level code execution compromising the entire WordPress install and the PHP process it runs under. The vector also specifies AV:N/PR:N/UI:N/AC:L, i.e. reachable over the network, unauthenticated, with no user interaction and low attack complexity, so a default installation with the plugin active is sufficient. The reporting source is Patchstack, a WordPress-focused vulnerability database, which is consistent with a plugin-level advisory. The advisory does not disclose which feature, file, or endpoint contains the injection point, so defenders cannot scope exposure more narrowly than 'plugin installed and active'.
Know when Siteskite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated remote code injection (CWE-94) needs no privileges or interaction; RCE escaping the plugin into the host web context justifies S:C and full C/I/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
Articles & Coverage 1
Executive ViewAI
The SiteSkite WordPress plugin, up to and including version 2.1.8, contains a critical unauthenticated remote code execution flaw (CVE-2026-96349, CVSS 10.0) that allows any internet-facing attacker to execute arbitrary code on an affected site without credentials or user interaction. Because this is a niche plugin, exposure across the organization is likely limited to a small number of marketing or departmental WordPress sites, but any single affected instance can yield full control of the site and its underlying host, making containment and inventory the immediate leadership priorities. No vendor patch, no public exploit code, and no confirmed active exploitation have been identified at the time of analysis, so this is a manage-and-mitigate exposure rather than an active incident.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the SiteSkite plugin from all WordPress instances at version 2.1.8 or earlier; where removal is not immediately possible, block all external access to the plugin's endpoints at the WAF or reverse proxy, restrict administrative access by IP allowlist, enable file-integrity monitoring on the webroot, and review logs for signs of arbitrary code execution or webshell creation. Only re-enable the plugin once the vendor releases a fixed version that has been validated in a staging environment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated privilege escalation in the SiteSkite WordPress plugin (versions ≤ 2.1.5) allows a remote attacker to ga
Insecure direct object reference (IDOR) in the SiteSkite WordPress plugin versions up to 2.1.7 allows authenticated atta
Exploit-DB