---
id: "CVE-2026-105894"
kind: "vulnerability"
aliases: ["CVE-2026-105894"]
title: "WordPress Ak Framework plugin lets anonymous visitors gain administrator rights"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ak-framework", "newsy-theme", "package", "self-hosted", "wordpress"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-10-30T18:17:16+00:00"
first_seen_at: "2026-10-30T18:55:28+00:00"
updated_at: "2026-10-30T18:56:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105894", "first_seen_at": "2026-10-30T18:55:28+00:00"}]
---

# WordPress Ak Framework plugin lets anonymous visitors gain administrator rights

The Ak Framework plugin bundled with the Newsy WordPress theme has missing capability checks in its AJAX handlers, so it passes attacker-chosen option names and values to update_option(). An unauthenticated attacker can enable user registration and set the default role to administrator, then sign up as an admin.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Newsy - Viral News & Magazine theme is installed and whether the Ak Framework plugin is present in the site's plugins folder.
- Check the installed Ak Framework plugin version; the sources say versions up to and including `2.9.8` are affected.
- Check the `users_can_register` and `default_role` options in the WordPress database or Settings > General for unexpected values like `administrator`.

## Fix

- Ak Framework plugin: move to a version later than `2.9.8`; the sources do not name the fixed version.

## Timeline

- 2026-10-30T18:55:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105894

## From the sources

The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_