CVE-2026-75796CWE-269privilege-escalation

CVE-2026-75796

High · published August 21, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-08-21T11:16Z
References (1)
https://wpscan.com/vulnerability/919da0c7-7643-4903-9454-2fb66353f5cb/ · [email protected]
EPSS history
Timeline
  • 21 AUG 06:00Z
    AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools
    cvelistv5