{"id":"CVE-2026-105894","kind":"vulnerability","aliases":["CVE-2026-105894"],"related":[],"title":"WordPress Ak Framework plugin lets anonymous visitors gain administrator rights","description":"The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.","summary":"The Ak Framework plugin bundled with the Newsy WordPress theme has missing capability checks in its AJAX handlers, so it passes attacker-chosen option names and values to update_option(). An unauthenticated attacker can enable user registration and set the default role to administrator, then sign up as an admin.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ak-framework","newsy-theme","package","self-hosted","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- Check whether the Newsy - Viral News & Magazine theme is installed and whether the Ak Framework plugin is present in the site's plugins folder.\n- Check the installed Ak Framework plugin version; the sources say versions up to and including `2.9.8` are affected.\n- Check the `users_can_register` and `default_role` options in the WordPress database or Settings > General for unexpected values like `administrator`.","fix":"- Ak Framework plugin: move to a version later than `2.9.8`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T18:17:16+00:00","first_seen_at":"2026-10-30T18:55:28+00:00","triaged_at":"2026-10-30T18:56:30+00:00","updated_at":"2026-10-30T18:56:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T18:56:30Z","model":"claude-haiku-5-5","output":{"fix":"- Ak Framework plugin: move to a version later than `2.9.8`; the sources do not name the fixed version.","reach":"internet","title":"WordPress Ak Framework plugin lets anonymous visitors gain administrator rights","impact":"high","summary":"The Ak Framework plugin bundled with the Newsy WordPress theme has missing capability checks in its AJAX handlers, so it passes attacker-chosen option names and values to update_option(). An unauthenticated attacker can enable user registration and set the default role to administrator, then sign up as an admin.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ak-framework","newsy-theme","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Anonymous attacker becomes a WordPress administrator and takes over the site","analyst_note":"Find the fixed Ak Framework version and the vendor advisory; the NVD entry alone does not name a patched release.","how_to_check":"- Check whether the Newsy - Viral News & Magazine theme is installed and whether the Ak Framework plugin is present in the site's plugins folder.\n- Check the installed Ak Framework plugin version; the sources say versions up to and including `2.9.8` are affected.\n- Check the `users_can_register` and `default_role` options in the WordPress database or Settings > General for unexpected values like `administrator`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the Newsy - Viral News & Magazine WordPress theme, or the Ak Framework plugin, at version `2.9.8` or earlier are exposed. The flaw is reachable without logging in, so any site on the internet with the plugin active is a target; sites without the theme or plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000763,"input_tokens":4229,"output_tokens":681,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105894':13A,16A '-2026':12A,15A '2.9.8':106C 'admin':78B,121C 'administr':9A,72B,159C,165C 'ajax':44B,116C,122C 'ak':2A,18B,29B,80C,120C 'ak-framework':17B 'anonym':6A 'arbitrari':145C 'attack':50B,61B,127C,142C 'attacker-chosen':49B 'attacker-control':126C 'bundl':32B 'capabl':40B,112C 'check':41B,113C 'chosen':51B 'control':128C 'cve':11A,14A 'default':69B,153C,168C 'due':109C 'enabl':63B,161C 'escal':98C,156C 'framework':3A,19B,30B,81C 'gain':8A 'handler':45B,123C 'host':26B 'includ':85C,105C,148C 'let':5A 'magazin':91C 'make':137C 'miss':39B,111C 'name':53B,130C 'news':90C 'newsi':21B,35B,88C 'newsy-them':20B 'nonc':118C 'option':52B,58B,129C,135C,147C 'packag':23B 'pass':48B,125C 'plugin':4A,31B,82C 'possibl':139C 'privileg':97C,157C 'refresh':117C 'regist':151C 'registr':65B,163C 'right':10A 'role':70B,154C,169C 'self':25B 'self-host':24B 'set':67B 'sign':74B 'theme':22B,37B,93C 'unauthent':60B,141C 'updat':57B,134C,144C 'user':64B,149C,162C 'valu':55B,132C 'version':101C 'viral':89C 'visitor':7A 'vulner':95C 'wordpress':1A,27B,36B,84C,92C,146C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Newsy - Viral News & Magazine WordPress theme, or the Ak Framework plugin, at version `2.9.8` or earlier are exposed. The flaw is reachable without logging in, so any site on the internet with the plugin active is a target; sites without the theme or plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105894","severity":null,"published_at":"2026-10-30T18:17:16+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:28+00:00","fetched_at":"2026-10-30T18:55:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}