CVE-2026-57692: WordPress PrivateContent plugin <= 9.9.2 - Privilege Escalation vulnerability

Synopsis

An incorrect privilege assignment vulnerability in the LCweb PrivateContent WordPress plugin (versions up to and including 9.9.2) allows unauthenticated attackers to escalate their privileges over the network. No login or user interaction is required to trigger the flaw. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected WordPress installation. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or session credentials are needed; the exploit is available to any unauthenticated HTTP client.

• Victim interactionNot required

  No user action is required; the attacker triggers the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special conditions, race windows, or environmental dependencies on the attacker.

Blast Radius

• A successful attacker gains an elevated or administrative WordPress role, allowing them to read any stored content, user records, and plugin configuration data.
• The attacker can modify or delete posts, pages, user accounts, plugin settings, and other persisted site data.
• With administrative access the attacker can install arbitrary WordPress plugins or themes, enabling remote code execution on the underlying server.
• The attacker can disable or corrupt the site, causing a denial of service for end users and administrators.