CVE Intelligence
Analysis AI-assisted

CVE-2026-32573: Nelio AB Testing WordPress Plugin up to 8.2.7 - Code Injection (CWE-94)

CVE-2026-32573 is a code injection flaw (CWE-94) in the Nelio AB Testing WordPress plugin, affecting versions through 8.2.7 as recorded by Patchstack. Patchstack and CISA-ADP both score it 9.1 (Critical) under CVSS 3.1, and the vector requires high privileges. The sources consulted show no fixed version and no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-32573 was published on 2026-03-25 with Patchstack as the CNA. The record classifies the weakness as CWE-94 (Code Injection) in the Nelio AB Testing plugin for WordPress. The record title describes the issue as remote code execution, while the official description only states code injection, so this analysis reports both without extending the description beyond the record.

Impact

  • The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, with a base score of 9.1 (Critical).
  • Confidentiality, integrity and availability impacts are rated High, and the scope is rated Changed.
  • Privileges Required is High, so the vector assumes the attacker already holds elevated privileges.
  • The SSVC data in the record rates technical impact as total and automatable as no.

Affected products and versions

  • Product: Nelio Software Nelio AB Testing (nelio-ab-testing), a WordPress plugin.
  • Affected range: all versions through 8.2.7 inclusive, as described in the record.
  • The record lists no fixed version. The absence of a listed fix does not mean none exists, so check the vendor and the Patchstack entry.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog, so active exploitation is not confirmed.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • The record gives an EPSS probability of 0.0054 (percentile 0.43877), dated 2026-10-13.
  • SSVC exploitation is recorded as none.

Remediation and mitigation

  • Identify every WordPress site running Nelio AB Testing and confirm the installed version.
  • Update to a release later than 8.2.7 once the vendor publishes one, and verify it against the official plugin changelog.
  • Until a fix is confirmed, limit high-privilege accounts to the minimum needed and remove unused accounts.
  • Keep WordPress core and other plugins current. A web application firewall with vendor-maintained rules can serve as a compensating control, but it does not replace patching.
  • Recheck the Patchstack entry periodically for updates to affected or fixed versions.

Detection guidance

  • Monitor plugin directories with file integrity tools and investigate unexpected changes to plugin files.
  • Review WordPress administrative activity, including new or modified accounts and recent configuration changes.
  • Review web server logs for unusual requests to the plugin from unexpected sources, interpreting results with vendor guidance.

Limitations of the available information

  • The record gives no fixed version and no vendor advisory.
  • The only vendor-side reference is the Patchstack database entry, alongside the NVD and CVE.org pages.
  • The RCE characterization in the title is not stated in the description, so the exact impact is unknown.
  • The EPSS date is later than the publication date and should be verified against the source.

Frequently asked questions

What is CVE-2026-32573?

It is a code injection vulnerability (CWE-94) in the Nelio AB Testing WordPress plugin, affecting versions through 8.2.7 as recorded by Patchstack.

What is the severity?

Patchstack and CISA-ADP list a CVSS 3.1 base score of 9.1 (Critical). The vector requires high privileges and shows a changed scope.

Is there a fixed version or known exploitation?

The record lists no fixed version, and it is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.