{"id":"CVE-2026-85118","published":"2026-10-11T07:17:25.900","lastModified":"2026-10-13T20:36:00.850","description":"The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/ba76e169-6c2a-489e-99df-a1c5d4aef24e/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The AI Content Generator Marketing WordPress plugin fails to verify nonces or user capabilities before processing AJAX requests, allowing any visitor to modify critical WordPress settings and potentially gain admin access. This represents a critical vulnerability that can lead to full site compromise.","exploitability":"Exploitation is straightforward with no prerequisites - attackers can immediately call the vulnerable AJAX endpoints to modify arbitrary options without authentication.","blast_radius":"The vulnerability could affect any WordPress site running version 1.0.0 or earlier of the AI Content Generator Marketing plugin, potentially leading to complete site takeover and data compromise.","remediation":"Upgrade to version 1.0.1 or later which includes nonce and capability checks for AJAX actions.","detection":"Monitor for unusual AJAX requests to wp-admin/admin-ajax.php with parameters targeting WordPress options like 'option_name' and 'option_value', particularly when originating from unauthenticated sessions.","tags":["wordpress","plugin","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:51:01.884Z"}}