Signal is active with 5 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin' function in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-2001 The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin' functio… https://www.cve.org/CVERecord?id=CVE-2026-2001
Post summary
The WowRevenue WordPress plugin has a missing capability check in 'Notice::install_activate_plugin', enabling unauthorized plugin installation; no exploit, patch, or active exploitation is reported.
CVE-2026-2001 WordPress WowRevenue Plugin Vulnerability Allows Unauthorized Plugin Installation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2001
Post summary
This is a disclosure of CVE‑2026‑2001 affecting the WordPress WowRevenue plugin, which permits unauthorized plugin installation.
🟠 CVE-2026-2001 - High The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin' function in all versions up to,... https://www.thehackerwire.com/vulnerability/CVE-2026-2001/ https://t.co/PsOxWluUG1
Post summary
The WowRevenue WordPress plugin is vulnerable to unauthorized plugin installation because of a missing capability check, with the CVE disclosed but no PoC, exploit, or patch details provided.
[CVE-2026-2001: HIGH] WordPress WowRevenue plugin up to 2.1.3 allows arbitrary plugin installation by authenticated attackers. Missing checks make remote code execution possible. #cybersecurity#cve,CVE-2026-2001,#cybersecurity https://cvefind.com/CVE-2026-2001
Post summary
The post announces CVE‑2026‑2001, a WordPress WowRevenue plugin flaw that allows authenticated attackers to install arbitrary plugins and potentially execute remote code due to missing validation checks.
🚨 HIGH severity alert: CVE-2026-2001 lets subscriber users install plugins in WowRevenue WordPress plugin (all versions ≤2.1.3). RCE risk for e-commerce sites — restrict permissions & monitor installs! 🔒 https://radar.offseq.com/threat/cve-2026-2001-cwe-862-missing-authorizati... https://t.co/ld2RCWeMZ6
Post summary
High severity alert on CVE‑2026‑2001, which lets subscriber users install plugins in WowRevenue WordPress (≤2.1.3) leading to RCE; recommends restricting permissions and monitoring installs.