# CVE-2026-96350: Estatik privilege escalation in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-96350-subscriber-privilege-escalation-in-estatik-4-3-5-versions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-96350 · Severity: critical · CVSS 9.8 · Published 2026-09-30

A privilege escalation vulnerability in the Estatik WordPress plugin allows subscriber-level users to gain administrator privileges and take full control of a website. Affected sites running version 4.3.5 or earlier face immediate risk of unauthorized site modification, data theft, and malware injection. The vulnerability requires only a valid subscriber account to exploit, making it a critical threat for any WordPress installation with this plugin active.

Technologies: [Estatik](https://junglewise.ai/threats/technologies/estatik). Vendors: [Estatik](https://junglewise.ai/threats/vendors/estatik).

## Quick answers

**Is CVE-2026-96350 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96350 being exploited in the wild.

**How severe is CVE-2026-96350?** Critical severity, with a CVSS score of 9.8, published 30 September 2026.

**Which products and versions are affected?** Estatik <= 4.3.5.

**Is there a fix for CVE-2026-96350?** A patch was published on 2026-09-24: Patch released in version 4.3.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96350 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-96350?** Check whether you run Estatik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability in Estatik allows a subscriber-level user to escalate privileges to administrator. The attack requires authentication as a subscriber user and likely involves a missing capability check or broken access control in the plugin code. Patches are available in version 4.3.6 and later.

## Affected products

- Estatik Estatik <= 4.3.5

## Timeline

- 2026-09-30: disclosed
- 2026-09-24: patched: Patch released in version 4.3.6

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/estatik/vulnerability/wordpress-estatik-plugin-4-3-5-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/estatik/vulnerability/wordpress-estatik-plugin-4-3-5-privilege-escalation-vulnerability?_s_id=cve)

## Related threats

- [Estatik SQL injection in administrator panel](https://junglewise.ai/threats/cve-2026-96345-administrator-sql-injection-in-estatik-4-3-5-versions)
- [Estatik unauthenticated cross-site scripting (XSS)](https://junglewise.ai/threats/cve-2026-81775-estatik-unauthenticated-cross-site-scripting-xss)