CVE-2026-2001
Unauthorized Plugin Installation in WowRevenue WordPress Plugin
Publication date: 2026-02-16
Last updated on: 2026-02-16
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| revenue | revenue | to 2.1.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WowRevenue plugin for WordPress has a security flaw in its 'Notice::install_activate_plugin' function up to version 2.1.3. This flaw is due to a missing capability check, which means that authenticated users with subscriber-level access or higher can install arbitrary plugins on the affected WordPress site.
Because these unauthorized plugin installations are possible, attackers may be able to execute remote code on the server hosting the WordPress site.
How can this vulnerability impact me? :
This vulnerability allows attackers with low-level authenticated access (subscriber or above) to install any plugin they choose on your WordPress site.
By installing arbitrary plugins, attackers could execute remote code on your server, potentially leading to full site compromise, data theft, defacement, or further malicious activities.
The impact includes high confidentiality, integrity, and availability risks as indicated by the CVSS score of 8.8.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves the WowRevenue WordPress plugin allowing authenticated users with subscriber-level access or higher to install arbitrary plugins due to a missing capability check.'}, {'type': 'paragraph', 'content': 'Detection can focus on monitoring for unauthorized plugin installation attempts or suspicious REST API calls related to plugin installation.'}, {'type': 'paragraph', 'content': "Since the vulnerability is in the 'Notice::install_activate_plugin' function and involves AJAX calls to 'wp_ajax_revx_install', you can look for unusual POST requests to admin-ajax.php with the action parameter 'revx_install'."}, {'type': 'list_item', 'content': "Use web server logs or network monitoring tools to filter POST requests to 'wp-admin/admin-ajax.php' with 'action=revx_install'."}, {'type': 'list_item', 'content': "Example command to search Apache logs for such requests: grep 'POST /wp-admin/admin-ajax.php' /var/log/apache2/access.log | grep 'action=revx_install'"}, {'type': 'list_item', 'content': 'Check WordPress plugin directory for any newly installed or unexpected plugins.'}, {'type': 'list_item', 'content': 'Audit user roles and permissions to identify any subscriber-level users performing plugin installation activities.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediate steps include:
- Update the WowRevenue plugin to a version later than 2.1.3 where the missing capability check is fixed.
- Restrict plugin installation capabilities to trusted administrator users only.
- Temporarily disable or remove the WowRevenue plugin if an update is not immediately available.
- Audit existing plugins installed on the site for any unauthorized additions.
- Review user roles and permissions to ensure no subscriber-level users have elevated privileges.
- Monitor logs for suspicious plugin installation attempts as a precaution.