Vulnerability · Published Sep 30, 2026 · Assigned by WPScan

CVE-2026-88797Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation

High 7.1

In plain English

A high-severity improper access control in Vayu X from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 90.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Vayu X	0 – before 1.0.6

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References

https://wpscan.com/vulnerability/250a7d7c-9c9b-4619-a6f4-533d29a30e23/ exploit, vdb-entry, technical-description