CVE-2026-65553 CRITICAL

CVE-2026-65553: WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability

Vendor Wbolt.com
Product Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件
Weakness CWE-94 · Code injection
Published August 6, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Spider Analyser WordPress plugin through version 2.1.3 contains a code injection vulnerability that allows unauthenticated attackers to run arbitrary PHP code on the site without user interaction. The vulnerability stems from insufficient input validation in the plugin's core functionality. An attacker can exploit this remotely over the network to gain full control of the WordPress installation, including reading sensitive data, modifying content, and disrupting service.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site and take complete control of the WordPress installation.

Potential impact on your site

04Site Impact

Complete compromise of the WordPress site, including data theft, malware injection, and service disruption.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 6, 2026 CVE published
August 6, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-52704 WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability CVE-2026-3132 Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview CVE-2026-27044 WordPress Total Poll Lite plugin <= 4.12.0 - Remote Code Execution (RCE) vulnerability CVE-2026-16144 Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter CVE-2025-52744 WordPress Inpersttion For Theme plugin <= 1.0 - Arbitrary Code Execution vulnerability