First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-34901

CriticalCVSS 9.8/10Last modified Oct 25, 2026

Description

Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Paul	iControlWP	<= 5.5.3

References

https://patchstack.com/database/wordpress/plugin/worpit-admin-dashboard-plugin/vulnerability/wordpress-icontrolwp-plugin-5-5-3-privilege-escalation-vulnerability?_s_id=cve

Timeline

Published: Jun 15, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-349027.1Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.CVE-2026-349035.4Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issu CVE-2026-349047.5Cross-Site Request Forgery (CSRF) vulnerability in Analytify Simple Social Media Share Buttons allows Cross Site Request Forgery.This issue CVE-2026-349056.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0.CVE-2026-349069.3Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In th CVE-2026-349075.1Wirtualna Uczelnia is vulnerable to Reflected Cross‑Site Scripting (XSS) due to insecure handling of the locale parameter across multiple en CVE-2026-3490810.0A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauth CVE-2026-3490910.0A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the u CVE-2026-3491010.0A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a CVE-2026-349117.7A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to ac CVE-2026-349124.3A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and CVE-2026-349134.3A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earl

CVE-2026-34901: Critical severity, CVSS 9.8 | Vulnix