{"id":"CVE-2026-39801","published":"2026-10-10T20:16:33.483","lastModified":"2026-10-13T13:28:15.717","description":"Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ai-copilot-content-generator/vulnerability/wordpress-aiwu-plugin-1-5-9-privilege-escalation-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A subscriber can escalate their privileges to gain full administrative access in AIWU versions 1.5.9 and earlier, allowing them to bypass authentication and perform critical system operations. This privilege escalation flaw enables attackers to fully compromise the application without needing valid credentials.","exploitability":"Exploitation is straightforward with no special preconditions required, as the vulnerability allows any authenticated subscriber to escalate their privileges to admin level through a direct access control bypass.","blast_radius":"The impact could be severe across all AIWU installations running versions 1.5.9 or earlier, potentially allowing attackers to fully compromise user accounts, access sensitive data, and perform administrative actions on the platform.","remediation":"Upgrade to AIWU version 1.5.10 or later to remediate this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","access-control","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:46:18.503Z"}}