Live › vulnerability › CVE-2026-115255
Go to dashboardThe WP Roster plugin for WordPress has an AJAX action with no capability or nonce checks. An unauthenticated attacker can call it to delete WordPress user accounts of roster members.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the WP Roster WordPress plugin before version 2.35 are exposed, since the flawed AJAX action is reachable without logging in. Sites that do not have the plugin installed are not affected. Sites that have already patched to 2.35 or later are not affected by this flaw.
No product ranges from the sources yet.
wp plugin list if WP-CLI is available.2.35.2.35 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.
This page as .md · .json · in your agent: get_signal("CVE-2026-115255")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.