CVE-2026-115257 · Package
NO FIX YET · SEE WHAT TO DO
The WP Roster WordPress plugin before 2.36 skips capability and nonce checks when writing its stored roster data. An unauthenticated attacker can overwrite, wipe or restore the content of any roster.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the WP Roster WordPress plugin before 2.36 are exposed, because the write path accepts requests without any login or nonce check. Sites that do not run this plugin, or that have already updated to 2.36 or later, are not affected. unknown for whether specific configurations change exposure.
Not affected if plugin-not-installed
Who cares wordpress, wp-roster
2.36; anything older is in the stated range2.36 or laterThe WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.