COURSECURE COURSES · CVE-2026-15309 · Package
FIX → 1.5.3 ✓ verified
The CourseCure Courses plugin for WordPress, up to and including version 1.5.1, has a missing capability check in its settings save handler. An authenticated subscriber can change WordPress options such as default_role and users_can_register, then register an account that becomes an administrator.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress sites running the CourseCure Courses plugin (by WishList Member) version 1.5.1 or lower that allow any logged-in account, even a subscriber. Such an account can overwrite site options such as default_role and users_can_register, then register a new administrator. Sites on 1.5.3+ or with no untrusted logged-in users and no open registration are lower risk.
Not affected if patched-1.5.3, plugin-not-installed, registration-closed-and-no-subscribers
Who cares courses, privilege-escalation, wordpress, wordpress-plugin
1.5.1 is vulnerable, 1.5.3 contains the fixUpgrade to 1.5.3
The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST parameters and calls update_option() with attacker-controlled keys and values without any authorization verification. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges to administrator by setting the default_role WordPress option to 'administrator' and users_can_register to '1', then registering a new account that is automatically granted full administrator access.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.5.3 or later (vendor changelog lists CVE-2026-15309 under Security in 1.5.3)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.