CVE-2026-34901 is an unauthenticated privilege escalation vulnerability in Paul iControlWP affecting versions up to and including 5.5.3. The issue stems from incorrect privilege assignment (CWE-266), allowing attackers to gain elevated privileges without authentication. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation of this vulnerability allows unauthenticated attackers to escalate privileges within the affected iControlWP installations, potentially leading to full system compromise, unauthorized data access, modification, or disruption of service. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected iControlWP installations and monitor for suspicious activity related to privilege escalation attempts.