---
id: "CVE-2026-15309"
page: "https://infrastack.ai/live/CVE-2026-15309"
kind: "vulnerability"
aliases: ["CVE-2026-15309"]
title: "CourseCure Courses WordPress plugin: subscribers can escalate to administrator"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "CourseCure Courses", "fixed": ["1.5.3"], "affected": "<= 1.5.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["courses", "package", "privilege-escalation", "wordpress", "wordpress-plugin"]
not_affected_if: ["patched-1.5.3", "plugin-not-installed", "registration-closed-and-no-subscribers"]
published_at: "2026-11-12T12:18:23+00:00"
first_seen_at: "2026-11-12T12:38:18+00:00"
updated_at: "2026-11-12T12:42:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15309", "first_seen_at": "2026-11-12T12:38:18+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/coursecure-courses/coursecure-courses-151-authenticated-subscriber-privilege-escalation-to-ajax-save-settings-endpoint", "first_seen_at": "2026-11-12T12:42:15+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/coursecure-courses/coursecure-courses-151-authenticated-subscriber-privilege-escalation-to-ajax-save-settings-endpoint", "https://my.wishlistmember.com/changelog/coursecure-courses-1-5-3/"]}]
exploit_sources: []
---

# CourseCure Courses WordPress plugin: subscribers can escalate to administrator

Link for people: https://infrastack.ai/live/CVE-2026-15309 (this .md is for agents)

The CourseCure Courses plugin for WordPress, up to and including version 1.5.1, has a missing capability check in its settings save handler. An authenticated subscriber can change WordPress options such as default_role and users_can_register, then register an account that becomes an administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CourseCure Courses affected <= 1.5.1 fixed 1.5.3

## How to check

Check the CourseCure Courses plugin version in Plugins > Installed Plugins or wp-content/plugins/; <= 1.5.1 is vulnerable, 1.5.3 contains the fix. Also check Settings > General: Membership/New User Default Role set to Administrator, or open registration you did not enable, and review Users for unexpected administrators.

## Fix

Update CourseCure Courses to 1.5.3 or later (vendor changelog lists CVE-2026-15309 under Security in 1.5.3). Then check Settings > General for default_role (should not be administrator) and users_can_register, and review administrator accounts.

## Timeline

- 2026-11-12T12:38:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-15309
- 2026-11-12T12:42:15+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/coursecure-courses/coursecure-courses-151-authenticated-subscriber-privilege-escalation-to-ajax-save-settings-endpoint — Vendor (WishList Member) changelog lists CVE-2026-15309 as security fix in 1.5.3 (2026-09-29); affected <=1.5.1 and mechanism from Wordfence. Not on WordPress.org. No exploitation/PoC seen.

## Documents

- [advisory] Wordfence: CourseCure Courses <= 1.5.1 privilege escalation https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/coursecure-courses/coursecure-courses-151-authenticated-subscriber-privilege-escalation-to-ajax-save-settings-endpoint
- [fix] CourseCure Courses 1.5.3 changelog (WishList Member) https://my.wishlistmember.com/changelog/coursecure-courses-1-5-3/

## From the sources

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST parameters and calls update_option() with attacker-controlled keys and values without any authorization verification. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges to administrator by setting the default_role WordPress option to 'administrator' and users_can_register to '1', then registering a new account that is automatically granted full administrator access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_