WordPress Plugin Vulnerabilities

iControlWP < 5.5.4 - Unauthenticated Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
worpit-admin-dashboard-plugin
Fixed in 5.5.4

References

CVE
CVE-2026-34901
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa59f00-49f5-43ff-b3fe-0a62f52b0257

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Jarno Vos (jarnovos)
Verified
No
WPVDB ID
2193bf29-1d37-41de-863b-fa4f9472d507

Timeline

Publicly Published
2026-04-07 (about 4 months ago)
Added
2026-04-16 (about 4 months ago)
Last Updated
2026-08-21 (about 2 days ago)

Other

Published
Title
Published
2019-05-31
Title
WP Live Chat Support < 8.0.33 - Missing Permission Checks on some REST API Calls
Published
2025-11-10
Title
EasyCommerce – AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 - 1.8.2 - Unauthenticated Privilege Escalation
Published
2026-08-07
Title
AI Copilot – Content Generator < 1.5.8 - Unauthenticated Privilege Escalation via Custom Workflow Route
Published
2025-08-18
Title
Real Spaces - WordPress Properties Directory Theme < 3.6 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member'
Published
2026-04-08
Title
Cart Abandonment Recovery for WooCommerce < 2.1.0 - Shop Manager+ Privilege Escalation