Critical· 9.8official fix available
CVE-2026-9810
The AI Copilot WordPress plugin fails to properly link OAuth access tokens to specific users. This allows anyone with a valid token to gain full administrator access to the website.
publishedJul 17, 2026
last modifiedJul 17, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
23th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 1, 2026
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
01
Who is affected
Users running the AI Copilot WordPress plugin in versions prior to 1.5.4.
02
Real-world impact
An attacker could take complete control of a website by creating new user accounts or elevating their own permissions to administrator status.
03
Why this severity
This is a critical vulnerability because it can be exploited remotely over the internet without any user interaction or prior authentication, granting full control over the system.
04
What to do about it
official fix available
recommended steps
- 01Update the AI Copilot WordPress plugin to version 1.5.4 or later
NVD description
05
Timeline
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →