Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-85118: AI Content Generator Marketing plugin lets anyone become admin
CVE-2026-85118 · published 5 days ago
Summary
The AI Content Generator Marketing plugin for WordPress (through version 1.0.0) does not verify who is making certain background requests, so anyone on the internet can change or delete the site's settings. This can let an attacker take full control of the website as an administrator. Upgrade to a patched version or remove the plugin immediately and review your site for unauthorized changes.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | ai content generator marketing | <= 1.0.0 |
Original advisory text
AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-269Improper Privilege Management
Timeline
Published11 Oct 2026
Updated15 Oct 2026
First seen11 Oct 2026
Track software like this
Free during beta