---
id: "CVE-2026-115255"
kind: "vulnerability"
aliases: ["CVE-2026-115255"]
title: "WP Roster WordPress plugin: unauthenticated users can delete roster member accounts"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-roster"]
not_affected_if: ["plugin-not-installed", "version-2.35-or-later"]
published_at: "2026-10-28T06:16:35+00:00"
first_seen_at: "2026-10-28T06:31:27+00:00"
updated_at: "2026-10-28T06:32:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115255", "first_seen_at": "2026-10-28T06:31:27+00:00"}]
---

# WP Roster WordPress plugin: unauthenticated users can delete roster member accounts

The WP Roster plugin for WordPress has an AJAX action with no capability or nonce checks. An unauthenticated attacker can call it to delete WordPress user accounts of roster members.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the WP Roster plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin list` if WP-CLI is available.
- Confirm whether the installed version is below `2.35`.

## Fix

- Update the WP Roster plugin to `2.35` or later.
- If the update cannot be applied, deactivate the plugin until it is patched.
- Review the WordPress user list for unexpected deletions of roster member accounts.

## Timeline

- 2026-10-28T06:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115255

## From the sources

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_