CVE-2026-48879

CriticalCVSS 9.8

Published: 01/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

The AIWU WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.4.17.

Risk Assessment

An attacker can gain elevated privileges in the system, potentially leading to full control of the WordPress site.

Recommendation

Update the AIWU plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in AIWU

See all

CVE-2026-65507Critical
Unauthenticated Privilege Escalation vulnerability in AIWU versions up to 1.5.6.
CVE-2026-59515Critical
The AIWU content generator plugin contains a blind SQL injection vulnerability in versions up to and including 1.5.4. An attacker can exploit improper neutralization of special elements in SQL commands.

Original NVD description (English source)

Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation. This issue affects AIWU: from n/a through 1.4.17.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS