External risk intelligence

SiteSkite Unauthenticated Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-96349

The vulnerability affects a WordPress plugin. WordPress plugins are commonly deployed as part of public-facing web applications, making the attack surface typically reachable from the internet.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in SiteSkite software, allowing unauthenticated remote code execution. This means an attacker could potentially gain control of affected systems over the network without needing any credentials. The primary concern is to confirm if your organization utilizes this specific software.

Unauthenticated remote code execution flaw exists.
Critical flaw impacts public-facing web applications.
Confirm if SiteSkite is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request over the network to a vulnerable SiteSkite installation. This could allow an unauthenticated attacker to execute arbitrary code on the affected server, potentially leading to a complete compromise of the system.

No authentication required.
Network-accessible vulnerable component.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code remotely on systems running SiteSkite. When supported by the advisory, this could affect system data and service behavior.

System data and service behavior at risk.
Remote code execution via network access.
Compromise of system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical unauthenticated remote code execution vulnerability in SiteSkite affects public-facing web applications and requires immediate attention. Owners of the application infrastructure and the SiteSkite plugin are likely responsible for its remediation. The first practical step is to identify all instances of the affected plugin, confirm their reachability from the internet, assess their business criticality, and then plan a coordinated response, potentially involving vendor engagement and temporary risk mitigation if immediate patching is not feasible.

Application owners should own the issue.
Verify plugin reachability and criticality.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SiteSkite?

SiteSkite is a WordPress plugin used to extend the functionality of sites built on the WordPress content management system. It serves as a software component that integrates with the core platform to manage specific web application tasks. Organizations typically deploy such plugins to add features to their public-facing web environments, which means SiteSkite operates within the broader WordPress application architecture.

What does CWE-94 mean for CVE-2026-96349?

CWE-94 refers to improper control of generation of code, often called code injection. In the context of this CVE, it means the software fails to properly sanitize input, allowing an attacker to supply their own instructions that the server then executes as if it were legitimate program code. This flaw gives an unauthorized party the ability to run arbitrary commands on the underlying system, resulting in a total compromise of the affected application.

How is this vulnerability triggered?

An attacker triggers this vulnerability by sending a specially crafted request over the network to the affected SiteSkite installation. No interaction from a logged-in user or previous authentication is required to initiate the attack. However, simply having the plugin installed is not enough; the attacker must be able to reach the vulnerable component via a network connection to deliver the malicious payload.

Is my site at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant to public-facing web applications. Because SiteSkite is a WordPress plugin, it is often deployed in environments accessible from the internet, increasing the likelihood that your instance is reachable by remote attackers. If your site is connected to the internet, it should be considered a potential target for this flaw.

What steps should I take if I use SiteSkite?

Your first step is to perform a comprehensive inventory to locate all active instances of the SiteSkite plugin across your infrastructure. Once identified, evaluate whether these instances are accessible from the internet and determine their importance to your business operations. Use this information to coordinate with your technical team to plan a security update or implement temporary measures to restrict network access until the plugin can be properly secured.

References

patchstack.com/database/wordpress/plugin/siteskite/vulnerability/wor…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.