Subscriber accounts can exploit a flaw in the AIWU WordPress plugin (versions ≤ 1.5.9) to elevate their privileges. The vulnerability enables a non‑administrator user to perform actions normally reserved for administrators, potentially allowing the attacker to modify site content, change settings, or gain full control of the website. This direct escalation of authority presents a severe risk to confidentiality, integrity, and availability of the affected WordPress installation.

The AIWU plugin for WordPress, developed by Sergey, is vulnerable when deployed in versions 1.5.9 or older. No other vendors, products, or versions are listed as affected.

The CVSS score of 9.8 indicates that the flaw carries very high severity. The EPSS score is not available, but the lack of a report in the CISA KEV catalog suggests that exploitable code may not yet be widely deployed. Attackers can likely invoke the vulnerability via the WordPress front‑end or via authenticated endpoints, using any subscriber role, making the exploit remotely viable. If executing the exploit, the attacker could gain administrative capabilities with no additional authentication or system compromise beyond normal plugin use.