CVE-2026-17540

The CVSS 8.8 rating for CVE-2026-17540 fundamentally misrepresents the severity of what's happening here. This isn't a typical privilege escalation — it's a complete collapse of WordPress's privilege model, and the scoring framework has no vocabulary for that. WordPress's subscriber role is designed to be a hollow shell: users who can read published content and edit their own profile. That's it. They cannot publish, cannot edit other users' content, cannot access settings. CVE-2026-17540 lets a subscriber read wp-config.php and expose database credentials, API keys, and salt values — achieving full site compromise without so much as touching an admin dashboard. The vulnerability didn't escalate your privileges; it escalated from 'literally cannot do anything' to 'full site compromise' in a single unaudited function call. The file read impact is permanent and compounding. Unlike a defacement or DoS that you recover from, those exposed credentials may persist across staging environments, CI/CD pipelines, or related services. A subscriber on a shared hosting node can potentially read wp-config.php from neighboring sites. The blast radius extends far beyond the single WordPress installation, and the CVSS scope metric has no way to model that. This is also the fourth time in eleven years that a WordPress file manager plugin has produced the identical vulnerability — same missing capability check, same subscriber exploitation path. The WordPress plugin API makes `current_user_can()` opt-in rather than opt-out, which means developers building file management features face zero friction to simply not check authorization. The secure path is invisible by default. If you're defending against this: patch immediately, but understand that the damage may already be done. Rotate every credential that lived in wp-config.php — database passwords, API keys, salts. Check your hosting environment for lateral movement. The 100,000+ sites still running unpatched versions mean the exposure window remains open indefinitely, and exploitation requires no skill, no tooling, and no special access — just knowing that subscribers exist and the plugin didn't check if they should.

Reviewed through automated stages and approved by a human before publication.