EUVD-2026-114234
GHSA-rq7c-4vhw-wv57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach admin-ajax handler unauthenticated
-
DeliverySend crafted ak_admin_ajax request
-
Exploitupdate_option sets users_can_register and default_role
-
ExecutionRegister account auto-granted administrator
-
ImpactFull site takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Ak Framework plugin to be active, which is the case on sites running the Newsy - Viral News & Magazine theme that ships it, in versions up to and including 2.9.8. Per the description, no authentication is required - the ak_admin_ajax and ajax_refresh_nonce handlers lack capability/nonce checks and are reachable by unauthenticated attackers, who directly control the option name and value passed to update_option(). Note the input CVSS vector states PR:L (authenticated), which contradicts the 'unauthenticated' description - verify with the vendor. The main limiting factor is footprint: exploitation only affects sites running this specific theme/plugin, and completing privilege escalation depends on the attacker then reaching the registration form after users_can_register is enabled. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated paper risk. The input CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw with full triad impact, and the vuln.today decision label is 'this_week'. Critically, the CVSS vector and the description conflict on privileges: the vector encodes PR:L (authenticated), but the description states the attack is performed by 'unauthenticated attackers' - if the description is correct the real severity is higher (effectively PR:N / ~9.8), so defenders should treat this as unauthenticated-capable until the vendor/NVD reconcile the vector. The impact is total site compromise: an attacker flips WordPress registration options to self-register an administrator account. EPSS is not provided (unknown) and the CVE is not on CISA KEV, so there is no evidence of mass exploitation yet; combined with Wordfence being the sole reporter this looks like a freshly disclosed, not-yet-weaponized flaw. However, the exploitation primitive (arbitrary update_option via an unauthenticated AJAX endpoint) is trivially scriptable and typical of WordPress bugs that get weaponized quickly, so the absence of KEV/EPSS should not materially lower urgency. |
| Exploit ScenarioDerived | A remote attacker sends a crafted admin-ajax request to the ak_admin_ajax or ajax_refresh_nonce handler, setting users_can_register=1 and default_role=administrator via the unguarded update_option() call. The attacker then uses the now-open WordPress registration form to create an account that is automatically granted administrator privileges, fully taking over the site. No public exploit was identified at time of analysis, but the technique is straightforward and well understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Privilege escalation in the Ak Framework WordPress plugin, bundled with the Newsy - Viral News & Magazine theme, through version 2.9.8 allows attackers to reach the ajax_refresh_nonce and ak_admin_ajax handlers and pass attacker-controlled option names and values into update_option(), including users_can_register and default_role. Setting those options to enable open registration with the administrator role gives an attacker a path to create an administrator account. The advisory describes the handlers as reachable without authentication, while the supplied CVSS vector specifies PR:L (authenticated), so the authentication prerequisite should be confirmed against the vendor advisory before scoping exposure; exploitation is limited to sites running this theme/plugin, and no public exploit code or CISA KEV entry appears in the supplied intelligence.
RemediationAI
Vendor-released patch: update the Ak Framework plugin to 2.9.9, the release referenced by the vendor changelog at https://docs.akbilisim.com/newsy/changelog/#v299, and confirm the installed plugin version on every site running the Newsy theme since the plugin ships with the theme and may otherwise be overlooked during theme updates; the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f99ab9-eb22-4766-81f2-647af1229815?source=cve should be cross-checked, particularly to resolve whether the handler is genuinely reachable unauthenticated, as the advisory description states, or requires the low-privileged authenticated access indicated by the supplied CVSS vector (PR:L). If updating cannot be done immediately, deactivating the Ak Framework plugin removes the vulnerable handlers, with the trade-off that Newsy theme features depending on the framework may stop working, so the impact on the site should be tested first on a staging copy. Edge filtering of requests to admin-ajax.php carrying the ak_admin_ajax or ajax_refresh_nonce actions can reduce exposure in the interim but is brittle because action names and parameters are attacker-controlled and legitimate theme AJAX traffic shares the same endpoint, so it may break theme functionality. Where these data points are available, review wp_options for unexpected changes to users_can_register and default_role and audit administrator accounts for unauthorized additions, reverting any tampering found.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Ak Framework is a companion plugin shipped with the Newsy theme that registers WordPress AJAX handlers (ajax_refresh_nonce and ak_admin_ajax) used for theme administration and settings refresh. According to the advisory, those handlers perform neither a capability check nor a nonce validation before accepting a caller-supplied option name and value and handing them to WordPress's update_option() API. Because update_option() writes directly to the wp_options table, controlling both the key and value lets an attacker modify security-relevant site settings such as users_can_register and default_role. This maps to CWE-269 (Improper Privilege Management): the flaw is an authorization failure on a privileged administrative operation rather than a memory-safety or injection bug. The CPE cpe:2.3:a:akbilisim:ak_framework:*:*:*:*:*:*:*:* covers all releases through 2.9.8. The provided sources do not detail how the handlers are registered (for example whether they are exposed via wp_ajax_nopriv), so the exact request path an unauthenticated caller would use is not described in the available materials, and the PR:L versus unauthenticated discrepancy in the supplied data remains unresolved.
Know when Ak Framework gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated attackers reach the AJAX handlers, so PR:N (not the input's PR:L); network, low-complexity, no UI, and admin takeover yields C/I/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.
Executive ViewAI
A high-severity privilege escalation vulnerability (CVE-2026-105894) affects the Ak Framework plugin bundled with the Newsy theme, enabling attackers to potentially create administrator accounts on vulnerable WordPress sites. This could lead to full site compromise, data breaches, and reputational damage, impacting any organization using this theme. Leadership should prioritize remediation due to the ease of exploitation and severe consequences.
Disable the Ak Framework plugin until a patch is available; use a WAF to restrict access to the vulnerable AJAX handlers; monitor for unauthorized admin account creation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB