CVE-2026-1720 - Vulnerability Analysis

Overview

WowOptin WordPress plugin <= 1.4.24 contains an unauthorized arbitrary plugin installation vulnerability caused by missing capability check in 'install_and_active_plugin' function, letting authenticated attackers with Subscriber-level access install and activate plugins.

Severity & Score

Impact

Authenticated attackers with Subscriber-level access can install and activate arbitrary plugins, potentially compromising the entire WordPress site.

Mitigation

Update to the latest version beyond 1.4.24.

References

• https://plugins.trac.wordpress.org/browser/optin/trunk/includes/utils/class-notice.php#L848
• https://plugins.trac.wordpress.org/changeset/3456826/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ee0c0e29-b117-4480-b5b7-995878af8c57?source=cve

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 5, 2026

🟠 CVE-2026-1720 - High (8.8) The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'install_and_active_plugin' func... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1720/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner