CVE-2026-1720: 
WordPress vulnerability analysis and mitigation

CVE-2026-1720 is a missing authorization vulnerability in the WowOptin: Next-Gen Popup Maker plugin for WordPress, allowing authenticated attackers with Subscriber-level access or higher to install and activate arbitrary plugins. It affects all versions of the plugin up to and including 1.4.24. The vulnerability was published on March 5, 2026, and was discovered and reported by Wordfence. It carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862: Missing Authorization) on the install_and_active_plugin function within the plugin's class-notice.php file. Because no authorization check validates whether the requesting user has administrative privileges, any authenticated user — including those with the lowest default WordPress role (Subscriber) — can invoke this function over the network without any additional preconditions. The vulnerable code is visible in the plugin's source repository, and a patch was introduced in changeset 3456826 (Wordfence, WordPress Trac, WordPress Changeset).

Successful exploitation allows a low-privileged authenticated attacker to install and activate any arbitrary WordPress plugin, effectively granting near-complete control over the WordPress installation. This can lead to full site compromise including unauthorized access to sensitive data, defacement or modification of website content, disruption of services, and potential lateral movement to underlying infrastructure via malicious plugin payloads (Wordfence, Red Hat CVE).

As of the time of reporting, no public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.037% (0.000370), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It has been detected by Qualys (detection ID 531078) (Wordfence, Qualys).

1. Reconnaissance: Identify WordPress sites running the WowOptin plugin (version ≤ 1.4.24) via passive enumeration (e.g., checking /wp-content/plugins/optin/ paths) or using tools like WPScan.
2. Obtain low-privilege credentials: Register or obtain a Subscriber-level account on the target WordPress site (e.g., via open user registration).
3. Authenticate: Log in to the WordPress site with the Subscriber-level account to obtain a valid session cookie or nonce.
4. Invoke the vulnerable function: Send an authenticated HTTP POST request to the WordPress admin AJAX endpoint (/wp-admin/admin-ajax.php) or the relevant REST route, calling the install_and_active_plugin action with a target plugin slug (e.g., a malicious plugin hosted on WordPress.org or a custom URL).
5. Activate malicious plugin: The server installs and activates the specified plugin without authorization checks, granting the attacker arbitrary code execution capabilities on the server (Wordfence, WordPress Trac).

• Network: Authenticated POST requests to /wp-admin/admin-ajax.php with action parameters referencing install_and_active_plugin from non-administrative user sessions.
• File System: Unexpected new plugin directories appearing under /wp-content/plugins/ not authorized by site administrators; presence of web shells or suspicious PHP files within newly installed plugin folders.
• Logs: WordPress debug or access logs showing plugin installation events (Plugin installed successfully) initiated by Subscriber-level user accounts; entries in wp-admin/admin-ajax.php access logs from low-privilege users.
• Database: New entries in the wp_options table under active_plugins corresponding to unauthorized plugin slugs.

Site administrators should immediately update the WowOptin plugin to a version beyond 1.4.24 that includes the fix introduced in changeset 3456826. If an immediate update is not possible, the plugin should be deactivated and removed from all affected WordPress installations. Administrators should audit currently installed plugins for any unauthorized additions and review user accounts for suspicious Subscriber-level registrations. Restricting open user registration and implementing plugin management controls (e.g., disabling plugin installation for non-admins) are recommended additional hardening steps (Wordfence, WordPress Changeset).

Wordfence published the vulnerability in their weekly WordPress vulnerability report for the week of March 2–8, 2026, highlighting it as part of broader plugin security coverage. The vulnerability was also picked up by automated security feeds including Qualys, INCIBE-CERT, and Red Packet Security shortly after disclosure. No notable individual researcher commentary or significant social media discussion beyond standard aggregator coverage has been observed (Wordfence Weekly Report, Red Hat CVE).