CVE-2026-96349

SiteSkite versions 2.1.8 and earlier have an unauthenticated remote code execution flaw classified as CWE-94 (code injection). It can be triggered over the network with low complexity and without credentials or user interaction, and CVSS 3.1 scores it 10.0 with changed scope and high impact to confidentiality, integrity, and availability. A successful attacker can run arbitrary code in the WordPress context and may fully compromise the site and the host it runs on. WordPress installations that still use SiteSkite at or below 2.1.8 are affected. The issue is not in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Update the SiteSkite WordPress plugin to a release newer than 2.1.8 as soon as the vendor publishes a fix. Until then, deactivate or remove the plugin if it is not required, and limit public access to affected sites. Review web and application logs for unexpected code execution, new administrator accounts, or other signs of compromise.