PT-2026-8384 · WordPress · Wowrevenue

Itthidej Aramsri · Published 2026-02-16 · Updated 2026-02-16 · CVE-2026-2001

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WowRevenue plugin for WordPress versions up to and including 2.1.3

Description The WowRevenue plugin for WordPress is susceptible to unauthorized plugin installation because of a missing capability check within the

Notice::install activate plugin

function. This allows authenticated attackers with subscriber-level access or higher to install arbitrary plugins on the affected WordPress site. Successful exploitation may lead to remote code execution.

Recommendations Versions prior to and including 2.1.3 should be updated to a newer, fixed version when available. As a temporary workaround, restrict user permissions to prevent subscribers and other low-privilege users from installing plugins. Monitor plugin installations for any unauthorized activity.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2001

Affected Products

Wowrevenue

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-2001 · Security Note
• https://t.me/cveNotify/152132 · Telegram Post
• https://twitter.com/CVEnew/status/2023508908908691947 · Twitter Post
• https://plugins.trac.wordpress.org/browser/revenue/tags/2.1.3/includes/notice/class-notice.php#L909 · Note
• https://twitter.com/CveFindCom/status/2023505538999345343 · Twitter Post
• https://twitter.com/offseq/status/2023502701149999106 · Twitter Post
• https://twitter.com/TheHackerWire/status/2023525952236777615 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2023498292974268437 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6d881f00-5985-45d5-9aab-d143a010d739?source=cve · Note