---
id: "CVE-2026-115257"
kind: "vulnerability"
aliases: ["CVE-2026-115257"]
title: "WP Roster WordPress plugin: unauthenticated users can overwrite any roster"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wp-roster"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-04T06:17:01+00:00"
first_seen_at: "2026-11-04T06:25:19+00:00"
updated_at: "2026-11-04T06:26:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115257", "first_seen_at": "2026-11-04T06:25:19+00:00"}]
---

# WP Roster WordPress plugin: unauthenticated users can overwrite any roster

The WP Roster WordPress plugin before 2.36 skips capability and nonce checks when writing its stored roster data. An unauthenticated attacker can overwrite, wipe or restore the content of any roster.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WP Roster version in the WordPress admin plugin list or in the plugin's main file header
- Compare the installed version against `2.36`; anything older is in the stated range

## Fix

- WP Roster: move to `2.36` or later

## Timeline

- 2026-11-04T06:25:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115257

## From the sources

The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_