CVE-2026-96349
CriticalCVSS 10.0Summary
The SiteSkite plugin in versions up to and including 2.1.8 contains an unauthenticated remote code execution (RCE) vulnerability. An attacker can execute arbitrary code on the server without logging in.
Risk Assessment
This allows full server compromise, data theft, and further network attacks, posing a critical threat.
Recommendation
Immediately update the SiteSkite plugin to a version newer than 2.1.8 to remove the RCE vulnerability.
Other vulnerabilities in SiteSkite
See all- CVE-2026-81805High
The SiteSkite plugin in versions up to 2.1.5 contains a Privilege Escalation vulnerability. An unauthenticated attacker can elevate their privileges.
- CVE-2026-93513Medium
The SiteSkite plugin in versions up to 2.1.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows a user with the Contributor role to access objects they should not have permission to. The lack of proper permission verification on object references enables manipulation of identifiers to gain unauthorized access.
Original NVD description (English source)
Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS