Live › vulnerability › CVE-2026-105894
The Ak Framework plugin bundled with the Newsy WordPress theme has missing capability checks in its AJAX handlers, so it passes attacker-chosen option names and values to update_option(). An unauthenticated attacker can enable user registration and set the default role to administrator, then sign up as an admin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the Newsy - Viral News & Magazine WordPress theme, or the Ak Framework plugin, at version 2.9.8 or earlier are exposed. The flaw is reachable without logging in, so any site on the internet with the plugin active is a target; sites without the theme or plugin can skip it.
No product ranges from the sources yet.
2.9.8 are affected.users_can_register and default_role options in the WordPress database or Settings > General for unexpected values like administrator.2.9.8; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.
This page as .md · .json · in your agent: get_signal("CVE-2026-105894")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.