Cyber Posture

CVE-2026-27983

Critical

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 18.4th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27983 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates this CVE by requiring timely identification, reporting, prioritization, and correction of the privilege escalation flaw in the LMS Elementor Pro plugin.

prevent

Enforces the principle of least privilege, directly countering the incorrect privilege assignment that enables unauthenticated attackers to escalate privileges.

prevent

Provides processes for managing accounts and privileges, helping to prevent and detect improper privilege assignments exploited by this vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote unauthenticated exploitation of public-facing WordPress plugin directly enables initial access via T1190 and privilege escalation via T1068 (CWE-266).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor Pro: from n/a through <= 1.0.4.

Deeper analysisAI

CVE-2026-27983 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the LMS Elementor Pro WordPress plugin by designthemes, which enables privilege escalation. The issue affects the lms-elementor-pro plugin in all versions from n/a through 1.0.4 inclusive. Published on 2026-03-05, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical.

An unauthenticated attacker (PR:N) with network access (AV:N) can exploit this vulnerability with low attack complexity (AC:L) and without requiring user interaction (UI:N). Successful exploitation allows privilege escalation, resulting in high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).

The Patchstack advisory provides further details on this WordPress plugin vulnerability, available at https://patchstack.com/database/Wordpress/Plugin/lms-elementor-pro/vulnerability/wordpress-lms-elementor-pro-plugin-1-0-4-privilege-escalation-vulnerability?_s_id=cve.

Details

CWE(s)

CVEs Like This One

CVE-2026-32520Shared CWE-266
CVE-2025-44655Shared CWE-266
CVE-2026-27051Shared CWE-266
CVE-2026-23800Shared CWE-266
CVE-2026-32519Shared CWE-266
CVE-2026-32488Shared CWE-266
CVE-2026-32916Shared CWE-266
CVE-2025-68869Shared CWE-266
CVE-2024-56000Shared CWE-266
CVE-2026-23550Shared CWE-266

References