CVE-2026-24968
Published: 25 March 2026
Summary
CVE-2026-24968 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires remediation of the specific software flaw enabling privilege escalation in Xagio SEO plugin versions through 7.1.0.30.
Enforces least privilege to prevent exploitation of incorrect privilege assignment allowing unauthenticated attackers to escalate privileges.
Mandates enforcement of access authorizations to block unauthorized privilege escalations via the plugin's flawed logic.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated network exploitation of public-facing WordPress plugin for privilege escalation (CWE-266).
NVD Description
Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO: from n/a through <= 7.1.0.30.
Deeper analysisAI
CVE-2026-24968 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Xagio SEO WordPress plugin (xagio-seo), which allows privilege escalation. The issue affects all versions from n/a through 7.1.0.30, as published on 2026-03-25.
The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), with attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and unchanged scope (S:U). Unauthenticated remote attackers can exploit it to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) through privilege escalation.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/xagio-seo/vulnerability/wordpress-xagio-seo-plugin-7-1-0-30-privilege-escalation-vulnerability?_s_id=cve.
Details
- CWE(s)