CVE-2026-39801
CriticalCVSS 9.8Summary
The AIWU plugin in versions up to and including 1.5.9 contains a privilege escalation vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.
Risk Assessment
An attacker with a basic account can gain elevated privileges in the system, potentially leading to website takeover and data access. This poses a serious threat to application security.
Recommendation
Update the AIWU plugin to a version newer than 1.5.9. Until then, restrict subscriber registration and monitor privilege changes.
Other vulnerabilities in AIWU
See all- CVE-2026-65507Critical
Unauthenticated Privilege Escalation vulnerability in AIWU versions up to 1.5.6.
- CVE-2026-59515Critical
The AIWU content generator plugin contains a blind SQL injection vulnerability in versions up to and including 1.5.4. An attacker can exploit improper neutralization of special elements in SQL commands.
- CVE-2026-48879Critical
The AIWU WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.4.17.
Original NVD description (English source)
Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS