Estatik WordPress plugin: Privilege escalation for Subscriber accounts

Summary

The Estatik WordPress real estate plugin up to and including version 4.3.5 contains a privilege escalation flaw (CWE-266, incorrect privilege assignment). According to the CVE record, an authenticated user with a Subscriber account can gain higher privileges, potentially up to full administrative control of the website. The CVSS vector rates the flaw as network-exploitable without privileges, but the description requires a Subscriber account, so the real risk depends on whether anyone can register on the site. The NVD analysis is still pending.

Affected

• Estatik plugin for WordPress, versions up to and including 4.3.5
• Required privilege per description: Subscriber

Fixed in

• Patchstack and the CVE record recommend updating to version 4.3.6 or later.
• Not confirmed: no vendor changelog or advisory found that names this CVE.

Workaround

• None found in the sources.
• Interim measures based on general practice: disable open user registration where not needed, review existing Subscriber accounts, and check user roles for unexpected changes.

Exploitation

• Not listed as known exploited (third-party aggregator shows KEV: No; CISA KEV not checked directly).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Patchstack expects exploitation and mitigation rules are available; no public proof of concept found, which does not prove none exists.

Our recommendation

• Identify all WordPress sites running Estatik 4.3.5 or earlier.
• Update to 4.3.6 or later, then verify against the Patchstack advisory that the fix is included.
• Disable open registration where it is not needed and audit Subscriber accounts and role changes.
• Watch for NVD and Patchstack updates, as the NVD record is still deferred.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Strix CVE-2026-96350 www.strix.ai
• CVE record mirror (threatint) cve.threatint.com
• CVE Brief cvebrief.com
• WordPress.org Estatik plugin page wordpress.org
• WP Rankings Estatik wp-rankings.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:53.