The vulnerability is an incorrect privilege assignment flaw in the WordPress AIWU plugin that allows attackers with user accounts to elevate their privileges to administrator or higher levels. This flaw is categorized as CWE-266 and carries a CVSS score of 9.8, indicating a severe risk to confidentiality, integrity, and availability of the affected WordPress site.

The flaw affects the Sergey AIWU plugin version 1.4.17 and earlier. WordPress sites that install or use these plugin versions are at risk if any user accounts are present under the plugin’s control.

With a very high CVSS score and no publicly known exploit probability data, the risk level is high. The issue is not currently listed in the CISA KEV catalog. It is inferred that an attacker can exploit the flaw by leveraging any existing user account to request administrative actions, as the plugin incorrectly grants higher privileges. The lack of an EPSS score means that exploitation likelihood cannot be quantified from current data.