WordPress Plugin Vulnerabilities

AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion

Description

The plugin does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.

Proof of Concept

Affects Plugins

Plugin icon
ai-content-generator-marketing
No known fix

References

CVE
CVE-2026-85118

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter
Enrico Marcolini - Claudio Marchesini - Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
ba76e169-6c2a-489e-99df-a1c5d4aef24e

Timeline

Publicly Published
2026-10-09 (about 2 days ago)
Added
2026-10-09 (about 1 day ago)
Last Updated
2026-10-09 (about 1 day ago)

Other

Published
Title
Published
2026-10-01
Title
Divi Membership < 2.3.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter
Published
2025-02-27
Title
DHVC Form < 2.4.8 - Unauthenticated Privilege Escalation
Published
2023-08-03
Title
WP Ultimate CSV Importer < 7.9.9 - Author+ Privilege Escalation
Published
2022-12-01
Title
ARMember < 5.6 - Unauthenticated Privilege Escalation
Published
2026-08-26
Title
Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms