CVE-2026-48879: WordPress AIWU plugin <= 1.4.17 - Privilege Escalation vulnerability

Synopsis

An incorrect privilege assignment vulnerability in the WordPress AIWU plugin (versions up to and including 1.4.17) allows any unauthenticated remote attacker to escalate their privileges within the WordPress installation. The vulnerability is reachable over the network and requires no account, no special configuration, and no interaction from a legitimate user. Successful exploitation gives the attacker full read, write, and availability impact, meaning they can take over the site, exfiltrate data, modify content, or disrupt service entirely. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress installation over the network; the vulnerability is exposed via a standard HTTP endpoint with no network-level restriction implied by the CVSS vector.

• AuthenticationNot required

  No account or session token is needed; the attacker can trigger privilege escalation as a completely anonymous HTTP client.

• Victim interactionNot required

  No legitimate user needs to visit a page, click a link, or take any action for the exploit to succeed.

• Attack complexityDetail

  The exploit is rated low complexity, meaning it is reliable and requires no race conditions, memory-layout knowledge, or other environmental prerequisites.

Blast Radius

• A successful attacker gains an elevated WordPress role (up to administrator), enabling full control over site content, installed plugins, and theme files.
• With write access at admin level, the attacker can plant backdoors or malicious code inside the WordPress installation, persisting access even after the plugin is removed.
• Confidential data stored in the WordPress database, including user credentials, private posts, and any personal information entered through forms, becomes readable to the attacker.
• The attacker can deactivate or delete plugins and themes, corrupt database content, or render the site unavailable to legitimate visitors.