CVE-2026-27395: WordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerability

Synopsis

An unauthenticated privilege escalation vulnerability affects the Support Board WordPress plugin in versions before 3.8.9. The flaw is reachable over the network and requires no credentials, allowing any remote user to elevate their privileges within the application. Successful exploitation gives an attacker full read, write, and availability impact on the affected WordPress site. A patched-image rebuild at version 3.8.9 is available on HarborGuard for environments running an affected version of the plugin.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress site via HTTP or HTTPS.

• AuthenticationNot required

  No account or credentials of any kind are needed; the privilege escalation is fully unauthenticated.

• Victim interactionNot required

  The attacker can exploit this vulnerability directly without any action from an administrator or other user.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental prerequisites.

Blast Radius

• An attacker gains elevated privileges within the WordPress application, enabling access to all stored site data including user records, private content, and plugin configuration.
• With write access, an attacker can modify posts, pages, settings, or install additional plugins and themes to establish persistence.
• Full availability impact means the attacker can disrupt or take down the WordPress site entirely.
• Privilege escalation at this level typically enables follow-on compromise of the underlying server if further weaknesses exist in the hosting environment.