CVE-2026-85118: AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion

Q: Who can exploit this issue?

Any unauthenticated remote user can exploit the affected AJAX actions. No valid WordPress account, privileges, or user interaction are required.

Q: What is the practical impact on an affected site?

An attacker can update or delete arbitrary WordPress options and use that access to obtain administrator access to the site. This can result in complete compromise of confidentiality, integrity, and availability.

Q: Which plugin versions are affected?

AI Content Generator Marketing versions through 1.0.0 are affected.

Published Oct 11, 2026

Updated

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.

Affected Software

1 affected component

WordPress AI Content Generator Marketing<=1.0.0

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote user can exploit the affected AJAX actions. No valid WordPress account, privileges, or user interaction are required.

What is the practical impact on an affected site?

An attacker can update or delete arbitrary WordPress options and use that access to obtain administrator access to the site. This can result in complete compromise of confidentiality, integrity, and availability.

Which plugin versions are affected?

AI Content Generator Marketing versions through 1.0.0 are affected.

CVE-2026-85118: AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact on an affected site?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact on an affected site?

Which plugin versions are affected?