Tools AI Risk Radar ai-incident-0195
Incident record
AIWU plugin allows subscribers to gain higher privileges
- Severity
- Critical
- Status
- Research
- Type
- Infra Vuln
- Target
- AIWU through 1.5.9
- Actor
- researcher
- CVE
- CVE-2026-39801
What happened
A WordPress subscriber can exploit a missing privilege check to gain higher privileges through the AIWU content plugin.
Patchstack published its disclosure on 6 October; the CVE followed on 10 October. Patchstack specifies Subscriber access as a prerequisite and gives CVSS 3.1 score 9.8. The access requirement follows its explicit privilege field; its published CVSS vector marks privileges as unnecessary. Its mitigation rule is separate from a released plugin fix. Patch status remains unconfirmed as of 11 October.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-39801
- Patchstack disclosurepatchstack.com/database/wordpress/plugin/ai-copilot-content-…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026