{"id":"CVE-2026-115255","kind":"vulnerability","aliases":["CVE-2026-115255"],"related":[],"title":"WP Roster WordPress plugin: unauthenticated users can delete roster member accounts","description":"The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.","summary":"The WP Roster plugin for WordPress has an AJAX action with no capability or nonce checks. An unauthenticated attacker can call it to delete WordPress user accounts of roster members.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-roster"],"not_affected_if":["plugin-not-installed","version-2.35-or-later"],"how_to_check":"- Check whether the WP Roster plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin list` if WP-CLI is available.\n- Confirm whether the installed version is below `2.35`.","fix":"- Update the WP Roster plugin to `2.35` or later.\n- If the update cannot be applied, deactivate the plugin until it is patched.\n- Review the WordPress user list for unexpected deletions of roster member accounts.","status":"open","published_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:20+00:00","updated_at":"2026-10-28T06:32:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WP Roster plugin to `2.35` or later.\n- If the update cannot be applied, deactivate the plugin until it is patched.\n- Review the WordPress user list for unexpected deletions of roster member accounts.","reach":"internet","title":"WP Roster WordPress plugin: unauthenticated users can delete roster member accounts","impact":"medium","summary":"The WP Roster plugin for WordPress has an AJAX action with no capability or nonce checks. An unauthenticated attacker can call it to delete WordPress user accounts of roster members.","category":"package","nicknames":[],"who_cares":["wordpress","wp-roster","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attackers delete WordPress user accounts of roster members.","analyst_note":"Confirm the affected version range and the exact AJAX action name from the NVD entry or the plugin changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-115255.","how_to_check":"- Check whether the WP Roster plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin list` if WP-CLI is available.\n- Confirm whether the installed version is below `2.35`.","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-2.35-or-later"],"who_is_affected":"Sites running the WP Roster WordPress plugin before version 2.35 are exposed, since the flawed AJAX action is reachable without logging in. Sites that do not have the plugin installed are not affected. Sites that have already patched to 2.35 or later are not affected by this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":3285,"output_tokens":615,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115255':14A,17A '-2026':13A,16A '2.35':62C 'account':11A,52B,85C 'action':35B,76C 'ajax':34B,75C 'allow':77C 'attack':44B,79C 'call':46B 'capabl':38B,67C 'check':41B,70C 'cve':12A,15A 'delet':8A,49B,81C 'host':21B 'member':10A,55B,88C 'nonc':40B,69C 'one':72C 'packag':18B 'perform':65C 'plugin':4A,29B,60C 'roster':2A,9A,25B,28B,54B,58C,87C 'self':20B 'self-host':19B 'unauthent':5A,43B,78C 'user':6A,51B,84C 'wordpress':3A,22B,31B,50B,59C,83C 'wp':1A,24B,27B,57C 'wp-roster':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Roster WordPress plugin before version 2.35 are exposed, since the flawed AJAX action is reachable without logging in. Sites that do not have the plugin installed are not affected. Sites that have already patched to 2.35 or later are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115255","severity":null,"published_at":"2026-10-28T06:16:35+00:00","modified_at":"2026-10-28T06:16:35+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}