CVE-2026-85118: AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion
Published Oct 11, 2026
·Updated
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
Affected Software
1 affected component
WordPress AI Content Generator Marketing<=1.0.0
Event History
Oct 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any unauthenticated remote user can exploit the affected AJAX actions. No valid WordPress account, privileges, or user interaction are required.
2
What is the practical impact on an affected site?
An attacker can update or delete arbitrary WordPress options and use that access to obtain administrator access to the site. This can result in complete compromise of confidentiality, integrity, and availability.
3
Which plugin versions are affected?
AI Content Generator Marketing versions through 1.0.0 are affected.