CVE-2026-27983
Published: 05 March 2026
Summary
CVE-2026-27983 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27983 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the LMS Elementor Pro WordPress plugin by designthemes, which enables privilege escalation. The issue affects the lms-elementor-pro plugin in all versions from n/a through 1.0.4 inclusive. Published on 2026-03-05, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.
An unauthenticated attacker (PR:N) with network access (AV:N) can exploit this vulnerability with low attack complexity (AC:L) and without requiring user interaction (UI:N). Successful exploitation allows privilege escalation, resulting in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).
The Patchstack advisory provides further details on this WordPress plugin vulnerability, available at https://patchstack.com/database/Wordpress/Plugin/lms-elementor-pro/vulnerability/wordpress-lms-elementor-pro-plugin-1-0-4-privilege-escalation-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9653
Vulnerability details
Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor Pro: from n/a through <= 1.0.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing WordPress plugin directly enables initial access via T1190 and privilege escalation via T1068 (CWE-266).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates this CVE by requiring timely identification, reporting, prioritization, and correction of the privilege escalation flaw in the LMS Elementor Pro plugin.
Enforces the principle of least privilege, directly countering the incorrect privilege assignment that enables unauthenticated attackers to escalate privileges.
Provides processes for managing accounts and privileges, helping to prevent and detect improper privilege assignments exploited by this vulnerability.