The iControlWP plugin for WordPress contains an unauthenticated privilege escalation flaw in versions 5.5.3 and earlier that allows an attacker without prior credentials to gain elevated administrative privileges. This flaw is classified as CWE-266, indicating a weakness in authentication controls and privilege management. An attacker who can exploit it can gain unrestricted control over the WordPress site, potentially accessing sensitive data, modifying site content, or installing additional malicious plugins.

The vulnerability affects the iControlWP plugin developed by Paul, used as a WordPress add‑on, and only the versions up to and including 5.5.3 are impacted.

With a CVSS score of 9.8 this issue is deemed critical, but the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA KEV. The exploit requires no authentication and can be performed from any location that can reach the WordPress site; thus the likely attack vector is remote network access to the site’s admin or plugin endpoints. Given the high severity, a successful exploitation would result in global compromise of the affected site.