CVE-2026-2001
Published: 16 February 2026
Summary
CVE-2026-2001 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-2001 is a vulnerability in the WowRevenue plugin for WordPress, affecting all versions up to and including 2.1.3. It stems from a missing capability check in the 'Notice::install_activate_plugin' function, enabling unauthorized plugin installation. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-862 (Missing Authorization).
Authenticated attackers with subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By calling the vulnerable function, they can install arbitrary plugins on the target WordPress site, which may enable remote code execution depending on the plugins installed.
References include the plugin's source code at line 909 of class-notice.php in version 2.1.3 (https://plugins.trac.wordpress.org/browser/revenue/tags/2.1.3/includes/notice/class-notice.php#L909) and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/6d881f00-5985-45d5-9aab-d143a010d739?source=cve), which security practitioners should review for additional details on detection and remediation.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7822
Vulnerability details
The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin' function in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with subscriber-level access and…
more
above, to install arbitrary plugins on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin allows low-privileged authenticated users to install arbitrary plugins, enabling exploitation of public-facing applications (T1190) and exploitation for privilege escalation (T1068) to achieve RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to system resources, directly mitigating the missing capability check that allows unauthorized plugin installation.
AC-6 applies least privilege to restrict subscriber-level users from performing administrative actions like plugin installation.
CM-11 prohibits or restricts user-installed software, preventing low-privilege attackers from installing arbitrary plugins.