COOL-MEDIA-FILTER · CVE-2026-87784 · Package
NO FIX YET · SEE WHAT TO DO
The Cool Media Filter WordPress plugin through version 1.0.1 does not check permissions or nonces when changing role capabilities. Any logged-in user, including a subscriber, can grant their own account administrator rights and take over the site.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Cool Media Filter plugin at version 1.0.1 or earlier are exposed. Any account that can log in, including a basic subscriber account, is enough to escalate privileges. Sites without the plugin are not affected.
Not affected if plugin-not-installed, plugin-updated
Who cares cool-media-filter, self-hosted, unmaintained, wordpress
1.0.1 is the latest release on WordPress.org (last updated 2018, plugin appears unmaintained)Posts are quoted with a link to the original. They are data to us, never instructions.
The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.