{"id":"CVE-2026-15309","kind":"vulnerability","aliases":["CVE-2026-15309"],"related":[],"title":"CourseCure Courses WordPress plugin: subscribers can escalate to administrator","description":"The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST parameters and calls update_option() with attacker-controlled keys and values without any authorization verification. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges to administrator by setting the default_role WordPress option to 'administrator' and users_can_register to '1', then registering a new account that is automatically granted full administrator access.","summary":"The CourseCure Courses plugin for WordPress, up to and including version 1.5.1, has a missing capability check in its settings save handler. An authenticated subscriber can change WordPress options such as default_role and users_can_register, then register an account that becomes an administrator.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CourseCure Courses","fixed":["1.5.3"],"affected":"<= 1.5.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["courses","package","privilege-escalation","wordpress","wordpress-plugin"],"not_affected_if":["patched-1.5.3","plugin-not-installed","registration-closed-and-no-subscribers"],"how_to_check":"Check the CourseCure Courses plugin version in Plugins > Installed Plugins or wp-content/plugins/; <= 1.5.1 is vulnerable, 1.5.3 contains the fix. Also check Settings > General: Membership/New User Default Role set to Administrator, or open registration you did not enable, and review Users for unexpected administrators.","fix":"Update CourseCure Courses to 1.5.3 or later (vendor changelog lists CVE-2026-15309 under Security in 1.5.3). Then check Settings > General for default_role (should not be administrator) and users_can_register, and review administrator accounts.","status":"open","published_at":"2026-11-12T12:18:23+00:00","first_seen_at":"2026-11-12T12:38:18+00:00","triaged_at":"2026-11-12T12:40:31+00:00","updated_at":"2026-11-12T12:42:15+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-12T12:40:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CourseCure Courses WordPress plugin: subscribers can escalate to administrator","impact":"high","summary":"The CourseCure Courses plugin for WordPress, up to and including version 1.5.1, has a missing capability check in its settings save handler. An authenticated subscriber can change WordPress options such as default_role and users_can_register, then register an account that becomes an administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","courses"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"subscriber account becomes administrator, gaining full site control","analyst_note":"Confirm the fixed version and whether a patch exists at the NVD entry or the plugin's WordPress.org page.","how_to_check":"- Check whether the CourseCure Courses plugin is installed and its version is `1.5.1` or lower, in the WordPress admin plugin list or the plugin directory under `wp-content/plugins/`.\n- Review the WordPress user list for unexpected administrator accounts.","plain_action":"","product_name":"CourseCure Courses","needs_analyst":true,"not_affected_if":["plugin-not-installed","registration-closed-and-no-subscribers"],"who_is_affected":"Sites running the CourseCure Courses WordPress plugin version 1.5.1 or earlier that allow subscriber accounts, including accounts that open registration makes available. Sites without the plugin, or with it disabled, are not exposed. The sources do not state a fixed version.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000767,"input_tokens":4655,"output_tokens":603,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether a patch exists at the NVD entry or the plugin's WordPress.org page.","search":"'-15309':12A,15A '-2026':11A,14A '1':158C '1.5.1':38B,89C 'accept':105C 'access':135C,170C 'account':67B,163C 'administr':9A,71B,143C,152C,169C 'ajax':100C 'arbitrari':106C 'attack':115C,130C 'attacker-control':114C 'authent':50B,129C 'author':122C 'automat':166C 'becom':69B 'call':110C 'capabl':42B,96C 'chang':53B 'check':43B,97C 'control':116C 'cours':2A,18B,29B,74C 'coursecur':1A,28B,73C 'coursecure':16A 'courses':17A 'cve':10A,13A 'default':58B,147C 'due':92C 'elev':139C 'escal':7A,22B,82C 'full':168C 'function':103C 'grant':167C 'handler':48B 'includ':36B,88C 'key':117C 'level':134C 'make':125C 'miss':41B,95C 'new':162C 'option':55B,112C,150C 'packag':19B 'paramet':108C 'plugin':4A,26B,30B,75C 'possibl':127C 'post':107C 'privileg':21B,81C,141C 'privilege-escal':20B 'regist':63B,65B,156C,160C 'role':59B,148C 'save':47B,101C 'set':46B,102C,145C 'subscrib':5A,51B,133C 'subscriber-level':132C 'updat':111C 'user':61B,154C 'valu':119C 'verif':123C 'version':37B,84C 'vulner':79C 'without':120C 'wordpress':3A,23B,25B,32B,54B,77C,149C 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the CourseCure Courses plugin (by WishList Member) version 1.5.1 or lower that allow any logged-in account, even a subscriber. Such an account can overwrite site options such as default_role and users_can_register, then register a new administrator. Sites on 1.5.3+ or with no untrusted logged-in users and no open registration are lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-12T12:42:15Z","by":"analyst","doc":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/coursecure-courses/coursecure-courses-151-authenticated-subscriber-privilege-escalation-to-ajax-save-settings-endpoint","run_id":3732}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["coursecurecourses","courses"],"ptokens":["coursecure","courses"],"labels":["courses","high","package","privilegeescalation","vendor","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-15309':12A,15A '-2026':11A,14A 'administr':9A 'cours':2A 'coursecur':1A 'coursecure':16A 'courses':17A 'cve':10A,13A 'escal':7A 'plugin':4A 'subscrib':5A 'wordpress':3A","search_b":"'1.5.1':38B 'account':67B 'administr':71B 'authent':50B 'becom':69B 'capabl':42B 'chang':53B 'check':43B 'cours':18B,29B 'coursecur':28B 'default':58B 'escal':22B 'handler':48B 'includ':36B 'miss':41B 'option':55B 'packag':19B 'plugin':26B,30B 'privileg':21B 'privilege-escal':20B 'regist':63B,65B 'role':59B 'save':47B 'set':46B 'subscrib':51B 'user':61B 'version':37B 'wordpress':23B,25B,32B,54B 'wordpress-plugin':24B","search_c":"'1':158C '1.5.1':89C 'accept':105C 'access':135C,170C 'account':163C 'administr':143C,152C,169C 'ajax':100C 'arbitrari':106C 'attack':115C,130C 'attacker-control':114C 'authent':129C 'author':122C 'automat':166C 'call':110C 'capabl':96C 'check':97C 'control':116C 'cours':74C 'coursecur':73C 'default':147C 'due':92C 'elev':139C 'escal':82C 'full':168C 'function':103C 'grant':167C 'includ':88C 'key':117C 'level':134C 'make':125C 'miss':95C 'new':162C 'option':112C,150C 'paramet':108C 'plugin':75C 'possibl':127C 'post':107C 'privileg':81C,141C 'regist':156C,160C 'role':148C 'save':101C 'set':102C,145C 'subscrib':133C 'subscriber-level':132C 'updat':111C 'user':154C 'valu':119C 'verif':123C 'version':84C 'vulner':79C 'without':120C 'wordpress':77C,149C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T12:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15309","severity":null,"published_at":"2026-11-12T12:18:23+00:00","modified_at":"2026-11-12T12:18:24+00:00","first_seen_at":"2026-11-12T12:38:18+00:00","fetched_at":"2026-11-12T12:38:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-15309:3732","url":"https://my.wishlistmember.com/changelog/coursecure-courses-1-5-3/","severity":null,"published_at":"2026-11-12T12:42:15+00:00","modified_at":"2026-11-12T12:42:15+00:00","first_seen_at":"2026-11-12T12:42:15+00:00","fetched_at":"2026-11-12T12:42:15+00:00","note":"Vendor (WishList Member) changelog lists CVE-2026-15309 as security fix in 1.5.3 (2026-09-29); affected <=1.5.1 and mechanism from Wordfence. Not on WordPress.org. No exploitation/PoC seen.","cites":["https://my.wishlistmember.com/changelog/coursecure-courses-1-5-3/","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/coursecure-courses/coursecure-courses-151-authenticated-subscriber-privilege-escalation-to-ajax-save-settings-endpoint"]}],"documents":[{"id":134878,"url":"https://my.wishlistmember.com/changelog/coursecure-courses-1-5-3/","title":"CourseCure Courses 1.5.3 changelog (WishList Member)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":134879,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/coursecure-courses/coursecure-courses-151-authenticated-subscriber-privilege-escalation-to-ajax-save-settings-endpoint","title":"Wordfence: CourseCure Courses <= 1.5.1 privilege escalation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}