CVE-2026-34901: iControlWP Privilege Escalation Vulnerability

CVE-2026-34901 Overview

CVE-2026-34901 is an unauthenticated privilege escalation vulnerability affecting the iControlWP WordPress plugin (also known as the Worpit Admin Dashboard plugin) in versions 5.5.3 and earlier. The flaw is classified under [CWE-266: Incorrect Privilege Assignment] and allows network-based attackers to gain elevated privileges on affected WordPress sites without prior authentication. Successful exploitation grants full control over WordPress installations that use the affected plugin, including the ability to manipulate content, install backdoors, and pivot into hosting infrastructure.

Critical Impact
Remote attackers can escalate to administrative privileges on WordPress sites without credentials, leading to full site takeover.

Affected Products

iControlWP WordPress plugin versions 5.5.3 and earlier
Worpit Admin Dashboard plugin (alternate distribution name)
WordPress installations using the affected plugin for multi-site management

Discovery Timeline

2026-06-15 - CVE-2026-34901 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-34901

Vulnerability Analysis

The iControlWP plugin provides remote multi-site WordPress administration capabilities. It exposes endpoints that accept commands from a centralized control panel and execute privileged actions on connected WordPress instances. The vulnerability stems from incorrect privilege assignment within these endpoints, allowing requests to perform administrator-level actions without first validating the requester's identity or authorization scope.

Because the plugin is designed to act on behalf of administrators, abused endpoints inherit elevated capabilities. An attacker who reaches the vulnerable interface can trigger privileged operations directly. The vendor advisory hosted by Patchstack confirms the impact on versions up to and including 5.5.3.

Root Cause

The root cause is improper privilege assignment [CWE-266] in plugin handlers that accept remote management requests. Authorization checks either rely on attacker-controllable inputs or are missing on code paths that perform administrative operations. As a result, the plugin grants elevated capabilities to unauthenticated callers.

Attack Vector

The vulnerability is exploitable over the network with low complexity and requires no user interaction or prior privileges. An attacker sends a crafted HTTP request to an exposed plugin endpoint on a target WordPress site. The endpoint processes the request as if it originated from an authorized management session and performs the requested privileged action, such as creating or promoting a user account to administrator.

No verified public exploit code is available at the time of writing. Defenders should treat unauthenticated requests to iControlWP endpoints as high-risk pending patching.

Detection Methods for CVE-2026-34901

Indicators of Compromise

Unexpected WordPress administrator or editor accounts created without a corresponding audit log entry from a known admin session.
Inbound HTTP requests targeting iControlWP or Worpit plugin paths (for example, requests referencing worpit or icontrolwp in the URI) from unknown source addresses.
New plugin or theme installations, modified wp-config.php, or unexpected scheduled tasks (wp_cron) appearing shortly after suspicious plugin endpoint traffic.
Outbound connections from the web host to unfamiliar command-and-control infrastructure following requests to plugin endpoints.

Detection Strategies

Monitor WordPress audit logs for privilege changes, new admin user creation, and role modifications that do not correlate with legitimate administrator activity.
Inspect web server access logs for unauthenticated POST requests to iControlWP plugin endpoints, especially from non-allowlisted IP addresses.
Compare installed plugin version against 5.5.3 across managed WordPress fleets and flag any host still running a vulnerable version.

Monitoring Recommendations

Centralize WordPress, web server, and host telemetry in a SIEM and alert on privilege escalation primitives such as set_role, wp_insert_user, and capability grants for administrator roles.
Baseline normal traffic to plugin management endpoints and alert on volume spikes or requests from previously unseen geographies.
Enable file integrity monitoring on the wp-content/plugins/worpit-admin-dashboard-plugin directory and core WordPress files.

How to Mitigate CVE-2026-34901

Immediate Actions Required

Update the iControlWP/Worpit Admin Dashboard plugin to a version later than 5.5.3 as soon as the vendor publishes a fixed release.
If a patched version is not yet available, deactivate and remove the plugin from production WordPress installations.
Audit all WordPress user accounts for unauthorized administrator privileges and revoke any unexpected entries.
Rotate all administrator passwords, application passwords, and API keys associated with affected sites.

Patch Information

Refer to the Patchstack WordPress Vulnerability Notice for the current patched version and vendor remediation guidance. The advisory tracks the affected version range up to and including 5.5.3.

Workarounds

Restrict access to WordPress administrative and plugin endpoints using a web application firewall (WAF) rule that blocks unauthenticated requests to iControlWP paths.
Apply IP allowlisting at the reverse proxy or hosting layer so only known management infrastructure can reach the plugin's remote endpoints.
Enforce HTTP Basic Authentication or mutual TLS in front of wp-admin and plugin management URIs until the plugin is patched or removed.
Take a verified backup of the WordPress database and filesystem before performing remediation to support forensic review.

bash

# Configuration example: temporarily block iControlWP plugin endpoints at nginx
location ~* /wp-content/plugins/worpit-admin-dashboard-plugin/ {
    deny all;
    return 403;
}

# WP-CLI: deactivate and remove the vulnerable plugin
wp plugin deactivate worpit-admin-dashboard-plugin --allow-root
wp plugin delete worpit-admin-dashboard-plugin --allow-root

# Audit for unexpected administrator accounts
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --allow-root