anonhaven

CVE-2026-115255

NONE
Updated Oct 28, 2026
WordPress
Parameter Value
Affected Versions before 2.35
Type CWE-284 Improper Access Control
Vendor WordPress
Public PoC No

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.

Weakness Type (CWE)

CWE-284 Improper Access Control

Vulnerable Products

unknown:wp roster

References 1

https://wpscan.com/vulnerability/af573c89-e246-4c52-bd15-fa92c317c263/
contact@wpscan.com
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-92797

WordPress

8.8

CVE-2026-85655

WordPress

4.3

CVE-2026-101935

WordPress

6.1

CVE-2026-92098

WordPress

6.1

CVE-2026-77871

WordPress

6.4