CVE-2026-96350
CriticalCVSS 9.8Summary
The Estatik plugin in versions up to and including 4.3.5 allows a subscriber to escalate privileges. A low-privileged user can gain higher privileges.
Risk Assessment
This could lead to site takeover or access to administrative functions, threatening system integrity.
Recommendation
Update the Estatik plugin to a version newer than 4.3.5 to prevent privilege escalation.
Other vulnerabilities in Estatik
See all- CVE-2026-96345High
Administrator SQL Injection vulnerability in Estatik up to version 4.3.5.
- CVE-2026-81775High
Unauthenticated XSS vulnerability in Estatik versions up to 4.3.4. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2025-62963Medium
The Estatik plugin for WordPress (versions up to and including 4.3.1) is vulnerable to DOM-based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This may allow execution of malicious script in the user's browser.
Original NVD description (English source)
Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS