CVE-2026-1720 - Vulnerability Analysis

Overview

WowOptin WordPress plugin <= 1.4.24 contains an unauthorized arbitrary plugin installation vulnerability caused by missing capability check in 'install_and_active_plugin' function, letting authenticated attackers with Subscriber-level access install and activate plugins.

Severity & Score

Impact

Authenticated attackers with Subscriber-level access can install and activate arbitrary plugins, potentially compromising the entire WordPress site.

Mitigation

Update to the latest version beyond 1.4.24.

References

• https://plugins.trac.wordpress.org/browser/optin/trunk/includes/utils/class-notice.php#L848
• https://plugins.trac.wordpress.org/changeset/3456826/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ee0c0e29-b117-4480-b5b7-995878af8c57?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner