Aiwu
Monthly
Privilege escalation in the AIWU WordPress plugin (ai-copilot-content-generator) through version 1.5.9 lets a low-privileged Subscriber account elevate itself to a higher role, up to administrator, by abusing incorrect privilege assignment (CWE-266) in the plugin. Sites are fully exposed when the WordPress 'Anyone can register' option is enabled, since an attacker can self-provision the required Subscriber account; where registration is closed, the attacker must already hold or be granted such an account. Our independent assessment scores this as CVSS 9.8 with PR:L (Subscriber required), which conflicts with the supplied PR:N vector, so the unauthenticated framing should be verified against the Patchstack advisory; no public exploit identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing).
Unauthenticated privilege escalation in the AIWU (AI Copilot Content Generator) WordPress plugin versions 1.5.6 and earlier allows remote attackers with no authentication to gain elevated privileges within the WordPress site. Reported by Patchstack and tracked as EUVD-2026-53963, the flaw carries a CVSS 9.8 rating driven by network-reachable, no-interaction exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Blind SQL injection in the Sergey "AIWU" ai-copilot-content-generator WordPress plugin (all versions through 1.5.4) allows remote attackers to inject arbitrary SQL into backend database queries, per the CVSS:3.1 vector without requiring authentication or user interaction. Because the scope is changed and confidentiality impact is High, an attacker can exfiltrate sensitive database contents (WordPress user credentials, secrets, PII) via time- or boolean-based blind techniques. No public exploit identified at time of analysis and the issue is not on CISA KEV, but its high CVSS (9.3) and the fact that it was catalogued by Patchstack make it a credible risk for exposed WordPress sites.
Privilege escalation in the AIWU WordPress plugin (ai-copilot-content-generator) through version 1.5.9 lets a low-privileged Subscriber account elevate itself to a higher role, up to administrator, by abusing incorrect privilege assignment (CWE-266) in the plugin. Sites are fully exposed when the WordPress 'Anyone can register' option is enabled, since an attacker can self-provision the required Subscriber account; where registration is closed, the attacker must already hold or be granted such an account. Our independent assessment scores this as CVSS 9.8 with PR:L (Subscriber required), which conflicts with the supplied PR:N vector, so the unauthenticated framing should be verified against the Patchstack advisory; no public exploit identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing).
Unauthenticated privilege escalation in the AIWU (AI Copilot Content Generator) WordPress plugin versions 1.5.6 and earlier allows remote attackers with no authentication to gain elevated privileges within the WordPress site. Reported by Patchstack and tracked as EUVD-2026-53963, the flaw carries a CVSS 9.8 rating driven by network-reachable, no-interaction exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Blind SQL injection in the Sergey "AIWU" ai-copilot-content-generator WordPress plugin (all versions through 1.5.4) allows remote attackers to inject arbitrary SQL into backend database queries, per the CVSS:3.1 vector without requiring authentication or user interaction. Because the scope is changed and confidentiality impact is High, an attacker can exfiltrate sensitive database contents (WordPress user credentials, secrets, PII) via time- or boolean-based blind techniques. No public exploit identified at time of analysis and the issue is not on CISA KEV, but its high CVSS (9.3) and the fact that it was catalogued by Patchstack make it a credible risk for exposed WordPress sites.