AI Content Generator Marketing WordPress plugin: Unauthenticated privilege escalation
Summary
The AI Content Generator Marketing WordPress plugin up to and including version 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions. An unauthenticated remote attacker can update and delete arbitrary WordPress options without logging in. This can be used to gain administrator access to the affected site.
Affected
- AI Content Generator Marketing WordPress plugin (slug ai-content-generator-marketing), versions up to and including 1.0.0
- Vendor: Unknown
Fixed in
No known fix.
Workaround
- Deactivate and delete the plugin if it is not essential.
- If the plugin must remain, restrict access to the WordPress admin and AJAX endpoints at the network or WAF layer. This is not confirmed by any source for this flaw.
Exploitation
- No attacks in the wild known; CISA KEV: not listed.
- EPSS: 0.15% (per one source; NVD lists 0.146%).
- Public proof of concept: unclear, not confirmed.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
Our recommendation
- Check whether the plugin is installed on any WordPress site, especially internet-facing ones.
- Remove or disable the plugin, as no fix is available.
- Review administrator accounts, changed site options and unfamiliar plugins or files for signs of compromise.
- Monitor the WPScan and NVD pages for a fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan wpscan.com
- NVD (via Vulners) vulners.com
- VulDB vuldb.com
- Patchstack (via Vulners) vulners.com
- OpenCVE app.opencve.io
- Positive Technologies (via Vulners) vulners.com
- GitHub issue (KEV/EPSS reference) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:16.
Original description (NVD)
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.