---
id: CVE-2026-85118
title: >-
  The AI Content Generator Marketing WordPress plugin through 1.0.0 does not
  enforce a nonce or capability check on some of its AJAX actions, allowing
  unauthenticated users to update and delete arbitrary WordPress options, which
  can be use…
summary: >-
  The AI Content Generator Marketing WordPress plugin through 1.0.0 does not
  enforce a nonce or capability check on some of its AJAX actions, allowing
  unauthenticated users to update and delete arbitrary WordPress options, which
  can be use…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T12:17:24.063'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85118'
references:
  - url: 'https://wpscan.com/vulnerability/ba76e169-6c2a-489e-99df-a1c5d4aef24e/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-11T08:44:24.719Z'
epss: 0.00146
epssPercentile: 0.03385
---

## Overview

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.