CVE-2026-34901: WordPress iControlWP plugin <= 5.5.3 - Privilege Escalation vulnerability

Synopsis

An unauthenticated privilege escalation vulnerability affects the WordPress iControlWP plugin at version 5.5.3 and earlier. The flaw is reachable over the network and requires no credentials, meaning any external attacker who can reach the WordPress installation can trigger it. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected site. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress installation.

• AuthenticationNot required

  No account or session credential of any kind is needed to trigger the privilege escalation.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link or take any action for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race condition, memory layout manipulation, or other environmental precondition.

Blast Radius

• A successful attacker escalates to a privileged WordPress role, gaining the ability to read all site content, user data, and stored credentials.
• The attacker can modify or delete posts, pages, plugin settings, and site configuration, permanently altering persisted data.
• The attacker can install or activate malicious plugins and themes, enabling persistent backdoor access or full server-level compromise depending on hosting configuration.
• The attacker can disrupt site availability by deactivating plugins, corrupting settings, or exhausting server resources.