Estatik CVE-2026-96350

Requires the Estatik plugin (version 4.3.5 or earlier) installed on a WordPress site, and - per the 'Subscriber Privilege Escalation' description - an authenticated low-privileged Subscriber account, which is trivially obtainable where open user registration is enabled (common on real-estate/listing sites). The limiting factor is this authentication prerequisite: despite the published vector's PR:N, the description indicates a Subscriber-level account is needed, so exploitation is not truly anonymous. No user interaction by a victim is required. No non-default server configuration is indicated beyond having the vulnerable plugin active.

The headline CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which on its face signals a critical, remote, unauthenticated compromise. However, there is a clear internal conflict: the description explicitly labels this a 'Subscriber Privilege Escalation,' which means an attacker must already hold a low-privileged authenticated Subscriber account - that is inconsistent with the PR:N (no privileges required) in the published vector. This mismatch strongly suggests the true privilege requirement is PR:L, which would reduce the realistic base score to roughly 8.8. CWE-266 (Incorrect Privilege Assignment) is consistent with a Subscriber being able to elevate to a higher role (e.g., editor/admin-equivalent), which for a WordPress plugin can effectively lead to full site takeover. On real-world signals: there is no EPSS score, no CISA KEV listing, and no public proof-of-concept referenced - the only source is a single Patchstack advisory. There is no SSVC decision data provided. Net assessment: this is a genuinely serious flaw because privilege escalation on WordPress often chains to full compromise, but the 'unauthenticated CVSS 9.8' framing likely overstates it - realistic risk is high-but-gated-by-an-account, and the low-confidence single-source, no-exploit posture argues for prompt patching rather than emergency treatment. Verify the actual privilege prerequisite with the vendor advisory before treating this as unauthenticated.

An attacker registers a low-privileged Subscriber account on a WordPress site running Estatik <= 4.3.5 (open registration is common on real-estate listing sites), then abuses an insecure privilege-assignment code path to grant their own account elevated capabilities. With an elevated role they can manipulate content, plugin settings, or user roles, plausibly escalating to full administrative control of the site. No public exploit code is referenced at time of analysis.