SiteSkite Plugin EUVD-2026-75533

Exploitation requires a publicly reachable WordPress installation with the SiteSkite plugin active and running version 2.1.5 or earlier. No authentication is required (PR:N). The AC:H metric indicates a non-trivial condition must be met - the exact condition is not detailed in available data but is likely a timing dependency, specific request ordering, or configuration-sensitive code path within the plugin's privilege assignment logic. Exploitation is not trivially automatable at scale due to AC:H. There is no evidence of a required non-default WordPress configuration beyond having the plugin installed and active.

The CVSS 8.1 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H presents a serious but conditionally exploitable risk. The PR:N confirms unauthenticated exploitation, and the C:H/I:H/A:H triad reflects full site takeover once exploited. The AC:H metric is the primary limiting factor, indicating exploitation is not trivially automatable - an attacker must satisfy a specific precondition such as a timing window, specific request structure, or particular site configuration. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog. EPSS data is not provided. Real-world risk is meaningful for any site running SiteSkite ≤ 2.1.5, but the AC:H requirement limits drive-by mass exploitation; targeted exploitation by a motivated attacker is the more plausible threat model. Patchstack is the sole reporting source, which is a reputable WordPress-focused security firm.

An unauthenticated remote attacker sends a crafted HTTP request (or sequence of requests) to the target WordPress site running SiteSkite ≤ 2.1.5, triggering the incorrect privilege assignment code path. Upon satisfying the AC:H condition - which may involve a race condition or specific parameter combination - the attacker's account or a newly created account is assigned Administrator-level privileges within WordPress. The attacker then logs in with full admin access, enabling plugin installation, theme modification, or arbitrary PHP execution via WordPress native functionality. No public proof-of-concept has been identified at time of analysis.