EUVD-2026-96763
GHSA-rx89-7fw5-qgmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
DeliverySend unauthenticated AJAX request
-
ExploitUpdate/delete arbitrary wp_options
-
ExecutionEscalate to administrator role
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the AI Content Generator Marketing plugin (version ≤1.0.0) installed and active on the target WordPress site. Exploitation targets specific AJAX actions that lack both nonce verification and capability checks, so no authentication, user interaction, or non-default configuration is required (AV:N/AC:L/PR:N/UI:N). The only meaningful limiting factor is the plugin's apparent rarity and the requirement that the vulnerable AJAX endpoints be reachable; no particular PHP, platform, or WordPress feature toggle is noted as a prerequisite. |
| Impact | All available signals point to genuinely high risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction and high impact to confidentiality, integrity, and availability (9.8 Critical), which is fully consistent with the description: missing nonce and capability checks on AJAX actions let unauthenticated users update and delete arbitrary WordPress options, a well-understood path to full administrator takeover. Publicly available exploit code exists (reported by WPScan), raising practical exploitability beyond theory. However, no EPSS score was supplied and the CVE is not on the CISA KEV list, so there is no confirmation of active, widespread exploitation - the signals are 'critical severity plus public POC' rather than 'confirmed in-the-wild abuse.' The mitigating real-world factor is deployment footprint: this is an obscure plugin at version 1.0.0 with an unknown vendor, so despite the maximal CVSS the aggregate priority is tempered by likely low installation numbers. Net: treat as high priority for any site that actually runs this plugin, but its blast radius across the WordPress ecosystem is probably small. |
| Exploit ScenarioDerived | An attacker identifies a WordPress site running the AI Content Generator Marketing plugin (≤1.0.0) and, without authenticating, sends a crafted AJAX request to the unprotected action to overwrite core WordPress options (for example enabling open user registration and setting the default role to administrator, or injecting admin-level values). Public exploit code from WPScan lowers the effort, letting the attacker register or elevate an account to administrator and seize full control of the site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated attackers can update and delete arbitrary WordPress options through the AI Content Generator Marketing plugin (versions through 1.0.0), a capability that typically enables full site takeover by, for example, flipping the default new-user role to administrator and enabling open registration. The plugin's AJAX handlers perform neither a nonce check nor a capability check, and because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C/I/A all High, no authentication, user interaction, or non-default configuration is required - only that the plugin be installed and active and its endpoints reachable. Publicly available exploit code exists (ratings from WPScan), making opportunistic mass scanning realistic; there is no CISA KEV confirmation of active exploitation and no EPSS score was supplied, so this should be treated as high-severity, readily exploitable, but not yet confirmed as exploited in the wild. All available signals point to genuinely high risk.
RemediationAI
No vendor-released patch identified at time of analysis - version 1.0.0 is the latest affected release and no fixed version is documented in the provided references - so the primary action is to deactivate and completely remove the AI Content Generator Marketing plugin from all WordPress installations; deletion is preferred over deactivation because an inactive-but-present plugin can be reactivated by an attacker who already has admin access. If business requirements force the plugin to remain temporarily, apply compensating controls with awareness of their trade-offs: block POST requests to /wp-admin/admin-ajax.php carrying the plugin's vulnerable action parameters at the WAF or reverse proxy (effective only if the action names are enumerated from plugin source - over-broad blocking of admin-ajax.php will break legitimate front-end functionality across plugins), or restrict access to the plugin's AJAX endpoints by IP or authenticated-session filter (breaks intended public-facing features of the plugin). In addition, monitor and alert on unexpected changes to security-relevant rows in wp_options - particularly default_role, users_can_register, siteurl, and home - audit the users and usermeta tables for rogue administrator accounts created before the plugin was removed, rotate all administrator passwords and WordPress auth salts/keys, and force a fresh malware scan of theme and plugin files. Consult the WPScan advisory at https://wpscan.com/vulnerability/ba76e169-6c2a-489e-99df-a1c5d4aef24e/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-85118 for any subsequently published fixed version and re-check before reinstalling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is CWE-269 (Improper Privilege Management): the plugin exposes AJAX actions that are reachable without authentication (WordPress wp_ajax_nopriv_* style handlers) and, per the advisory, omit both check_ajax_referer() nonce validation and current_user_can() capability checks. That combination lets any remote HTTP client invoke option-modifying code paths intended for privileged users, writing to or deleting rows in the WordPress options table (wp_options). WordPress options are security-critical configuration state: changing default_role to 'administrator', setting users_can_register to 1, or altering siteurl/home can yield a rogue administrator account or redirect authentication flows, which escalates the impact from a plugin-level bug to complete site compromise. The CPE supplied (cpe:2.3:a:unknown:ai_content_generator_marketing:*:*:*:*:*:*:*:*) indicates the vendor/product namespace is unresolved in NVD, consistent with a low-profile commercial or freemium plugin with a small install base; EUVD enumerates the affected range as AI Content Generator Marketing 0 ≤ 1.0.0. The assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) aligns with the advisory: the only limiting factor is plugin presence and endpoint reachability, not any PHP, platform, or WordPress feature toggle.
Know when Ai Content Generator Marketing gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Missing nonce/capability checks allow remote unauthenticated AJAX calls (AV:N/AC:L/PR:N/UI:N) that overwrite arbitrary options enabling admin takeover, yielding full C:H/I:H/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
Technical POC Analysis
CWE-269 Improper Privilege Management.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The AI Content Generator Marketing plugin for WordPress (versions through 1.0.0) contains a critical unauthenticated vulnerability that allows attackers to modify arbitrary site options, potentially leading to full site takeover. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis, putting any organization with this plugin installed and active on an internet-facing WordPress site at immediate risk of administrative compromise, data tampering, and service disruption. Leadership should treat this as a high-priority remediation effort because opportunistic mass scanning is realistic and the potential business consequences include loss of website integrity and customer trust.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating or uninstalling the vulnerable plugin, blocking unauthenticated access to the plugin's AJAX endpoints via WAF or web server rules (e.g., denying requests to /wp-admin/admin-ajax.php with plugin-specific action parameters), disabling open registration and ensuring the default user role is not administrator, and monitoring for indicators of compromise such as unexpected administrator accounts or option changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB