CVE-2026-96350

CriticalCVSS 9.8

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The Estatik plugin in versions up to and including 4.3.5 allows a subscriber to escalate privileges. A low-privileged user can gain higher privileges.

Risk Assessment

This could lead to site takeover or access to administrative functions, threatening system integrity.

Recommendation

Update the Estatik plugin to a version newer than 4.3.5 to prevent privilege escalation.

Other vulnerabilities in Estatik

See all

CVE-2026-96345High
Administrator SQL Injection vulnerability in Estatik up to version 4.3.5.
CVE-2026-81775High
Unauthenticated XSS vulnerability in Estatik versions up to 4.3.4. An attacker can inject a malicious script that executes in the victim's browser.

Original NVD description (English source)

Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS