{"id":"CVE-2026-85118","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-85118","generatedAt":"2026-10-28T00:57:20.591Z","title":"The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain…","description":"The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.","published":"2026-10-11T07:17:26.000Z","lastModified":"2026-10-13T20:36:01.000Z","status":"Deferred","sourceIdentifier":"contact@wpscan.com","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-269"],"affected":[],"epss":{"score":0.00341,"percentile":0.27428,"date":"2026-10-26","history":[{"date":"2026-10-11","score":0.00146,"percentile":0.03385}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"scored","label":"Newly scored","at":"2026-10-11T13:30:07.000Z","detail":{"from":null,"score":"9.8","severity":"CRITICAL","fromSeverity":null},"summary":"Now scored CVSS 9.8 CRITICAL."},{"kind":"new","label":"New CVE","at":"2026-10-11T07:17:26.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-11T07:17:25.900Z"},"summary":"New CVE, critical severity (CVSS 9.8)."}],"references":[{"url":"https://wpscan.com/vulnerability/ba76e169-6c2a-489e-99df-a1c5d4aef24e/","source":"contact@wpscan.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-85118","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}