CVE-2026-85118

Summary

The AI Content Generator Marketing WordPress plugin fails to verify nonces or user capabilities before processing AJAX requests, allowing any visitor to modify critical WordPress settings and potentially gain admin access. This represents a critical vulnerability that can lead to full site compromise.

Exploitability

Exploitation is straightforward with no prerequisites - attackers can immediately call the vulnerable AJAX endpoints to modify arbitrary options without authentication.

Blast radius

The vulnerability could affect any WordPress site running version 1.0.0 or earlier of the AI Content Generator Marketing plugin, potentially leading to complete site takeover and data compromise.

Detection

Monitor for unusual AJAX requests to wp-admin/admin-ajax.php with parameters targeting WordPress options like 'option_name' and 'option_value', particularly when originating from unauthenticated sessions.

Prioritized remediation

Upgrade to version 1.0.1 or later which includes nonce and capability checks for AJAX actions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.