Platform
wordpress
Component
nelio-ab-testing
Fixed in
8.2.8
CVE-2026-32573 describes a Remote Code Execution (RCE) vulnerability within the Nelio AB Testing WordPress plugin. This flaw allows attackers to inject and execute malicious code on vulnerable systems, potentially leading to complete compromise. The vulnerability impacts versions of the plugin prior to 8.2.8, and a patch is available in version 8.2.8.
The impact of this RCE vulnerability is severe. A successful exploit allows an attacker to execute arbitrary code on the WordPress server hosting the Nelio AB Testing plugin. This could lead to complete system takeover, including data theft, modification, or deletion. Attackers could also use the compromised server as a launchpad for further attacks against other systems on the network. Given the plugin's functionality (A/B testing), attackers could potentially manipulate testing results or inject malicious content into the website, impacting user experience and potentially spreading malware.
This vulnerability was publicly disclosed on 2026-03-25. The CVSS score of 9.1 (CRITICAL) indicates a high probability of exploitation. Public proof-of-concept (POC) code is likely to emerge, increasing the risk. It is recommended to prioritize patching this vulnerability due to its severity and potential for widespread exploitation.
Exploit Status
EPSS
0.06% (18% percentile)
CVSS Vector
The primary mitigation for CVE-2026-32573 is to immediately upgrade the Nelio AB Testing plugin to version 8.2.8 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily disabling the plugin to reduce the attack surface. While a direct WAF rule is difficult to implement due to the code injection nature, strict input validation on any user-supplied data used by the plugin could offer some limited protection. Monitor WordPress logs for suspicious activity, particularly code execution attempts.
Update to version 8.2.8, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-32573 is a critical Remote Code Execution vulnerability in the Nelio AB Testing WordPress plugin, allowing attackers to execute arbitrary code.
You are affected if you are using Nelio AB Testing versions prior to 8.2.8. Check your plugin version and update immediately.
Upgrade the Nelio AB Testing plugin to version 8.2.8 or later. If immediate upgrade is not possible, disable the plugin temporarily.
While active exploitation is not confirmed, the vulnerability's severity and public disclosure suggest a high likelihood of exploitation.
Refer to the Nelio Software website and WordPress plugin repository for the official advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.