CVE-2026-28165 UnitedOver, LLC CVE debrief

Who should care

Defenders responsible for WordPress installations with the Digits plugin should assess exposure and potential impact.

Why it matters

CVE-2026-28165 is a critical unauthenticated privilege escalation vulnerability in the Digits plugin versions up to 9.2, requiring verification of exposure and assessment of potential impact.

• Potential privilege escalation requires verification from official sources
• Unauthenticated exploitation allows for elevated privileges
• Defenders should verify exposure and assess potential impact

Technical summary

The vulnerability is an unauthenticated privilege escalation in the Digits plugin versions up to 9.2. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, as the vulnerability allows for unauthenticated privilege escalation.

Recommended defensive actions

• Verify exposure by checking if the Digits plugin version is 9.2 or earlier
• Assess potential impact by evaluating the privileges that could be escalated
• Consider upgrading to a patched version of the Digits plugin, if available

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The source-provided CVE metadata and NIST NVD detail page provide additional information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.