This vulnerability allows an unauthenticated actor to gain administrative privileges on a WordPress site that uses the AIWU plugin version 1.5.6 or older. The flaw arises because the plugin processes user input without proper access checks, allowing the attacker to elevate privileges and perform actions such as changing site settings, installing new plugins, or accessing sensitive data. The weakness is identified as CWE‑266.

The flaw exists in the WordPress AIWU plugin from Sergey, affecting all installations running version 1.5.6 or earlier. The plugin is released as a content generation tool for WordPress sites; upgrading to 1.5.8 or later removes the vulnerability.

The CVSS score of 9.8 indicates critical severity. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting no known public exploitation yet. However, the unauthenticated nature of the attack vector means any visitor can attempt exploitation, making it likely to be leveraged once a public exploit is released. No special environment or configuration is required beyond a standard WordPress installation with the vulnerable plugin.