PatchSiren cyber security CVE debrief
CVE-2026-34901 Paul CVE debrief
CVE-2026-34901 is a critical unauthenticated privilege escalation vulnerability in iControlWP versions <= 5.5.3. The vulnerability has a CVSS score of 9.8, indicating a high severity. The CVE was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-34901) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-34901).
- Vendor
- Paul
- Product
- iControlWP
- CVSS
- CRITICAL 9.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-15
- Original CVE updated
- 2026-06-15
- Advisory published
- 2026-06-15
- Advisory updated
- 2026-06-15
Who should care
Administrators and users of iControlWP versions <= 5.5.3 should be aware of this vulnerability and take necessary actions to mitigate it.
Technical summary
The vulnerability is caused by a weakness in the iControlWP plugin, specifically CWE-266. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high impact.
Defensive priority
critical
Recommended defensive actions
- Update iControlWP to a version greater than 5.5.3.
- Refer to [ref-4](https://patchstack.com/database/wordpress/plugin/worpit-admin-dashboard-plugin/vulnerability/wordpress-icontrolwp-plugin-5-5-3-privilege-escalation-vulnerability?_s_id=cve) for mitigation or vendor-prov
Evidence notes
The vendor and product information is currently unknown, but evidence suggests that the vulnerability is related to the iControlWP plugin.
Official resources
-
CVE-2026-34901 CVE record
CVE.org
-
CVE-2026-34901 NVD detail
NVD
-
Source item URL
nvd_modified
- Mitigation or vendor reference
CVE-2026-34901 was published on 2026-06-15T21:16:42.227Z and last modified on 2026-06-15T21:24:32.790Z.