CVE-2026-96349

Published Sep 30, 2026·Updated Sep 30, 2026

NVD Description

Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.

Public Exploits & PoCs1 found

PoC: CVE-2026-96349

CVE-2026-96349 — WordPress SiteSkite plugin ≤2.1.8 unauthenticated RCE (CVSS 10.0, CWE-94). PoCbit mass-exploit PoC: legacy API-key autologin (?token=) + REST MCP siteskite_execute_php eval chain; fixed in 2.2.0. Check/exploit/mass bulk, hits.txt & exploited.txt, --lab self-test. Catalog: https://pocbit.org/pocs/cve-2026-96349

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free