This critical privilege escalation vulnerability in the AIWU WordPress plugin enables unauthenticated attackers to gain unauthorized administrative access to the host application.

The software suffers from a CWE-266 Incorrect Privilege Assignment flaw, which permits unauthenticated remote attackers to elevate their access levels. This bypasses standard user authentication and authorization mechanisms.

Exploitation allows attackers to gain full administrative control, which may result in unauthorized data access, modification of site content, or the injection of malicious scripts. The CVSS score of 9.8 underscores the extreme risk of total system compromise posed by this vulnerability.

Immediate Action: Update the AIWU WordPress plugin to version 1.5.8 or later as recommended by the vendor.

Proactive Monitoring: Audit the WordPress user database for suspicious accounts with administrative roles and monitor web server access logs for anomalous activity.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out malicious requests that attempt to exploit privilege assignment flaws in the plugin.

Public Exploit Available: Unknown

The high severity of this vulnerability necessitates prompt remediation across all affected environments. Administrators should apply the specified update immediately to secure the application against potential unauthorized administrative access.