{"id":"CVE-2026-87784","kind":"vulnerability","aliases":["CVE-2026-87784"],"related":[],"title":"Cool Media Filter WordPress plugin lets any logged-in user become site administrator","description":"The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.","summary":"The Cool Media Filter WordPress plugin through version 1.0.1 does not check permissions or nonces when changing role capabilities. Any logged-in user, including a subscriber, can grant their own account administrator rights and take over the site.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cool-media-filter","fixed":[],"affected":"<= 1.0.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["cool-media-filter","package","self-hosted","unmaintained","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- WordPress admin > Plugins: look for Cool Media Filter (slug cool-media-filter); any installed version (1.0.1 is the latest published) is affected.\\n- With WP-CLI: wp plugin list --name=cool-media-filter\\n- Check Users for unexpected administrators and review role capabilities for subscriber accounts.","fix":"No fixed version known. 1.0.1 is the latest release on WordPress.org (last updated 2018, plugin appears unmaintained). Deactivate and delete the plugin.","status":"open","published_at":"2026-11-06T06:16:44+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:43+00:00","updated_at":"2026-11-06T06:44:27+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T06:41:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cool Media Filter WordPress plugin lets any logged-in user become site administrator","impact":"high","summary":"The Cool Media Filter WordPress plugin through version 1.0.1 does not check permissions or nonces when changing role capabilities. Any logged-in user, including a subscriber, can grant their own account administrator rights and take over the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","cool-media-filter","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gains administrator rights and takes over the whole site","analyst_note":"Confirm whether a fixed version exists beyond 1.0.1 and check the plugin's vendor or WPScan advisory for the fix.","how_to_check":"- Check whether the `Cool Media Filter` plugin is installed and its version in the WordPress admin under Plugins.\n- Review the installed plugin version against `1.0.1`; unknown whether a later version exists.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated"],"who_is_affected":"Sites running the Cool Media Filter plugin at version 1.0.1 or earlier are exposed. Any account that can log in, including a basic subscriber account, is enough to escalate privileges. Sites without the plugin are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000687,"input_tokens":4205,"output_tokens":534,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm whether a fixed version exists beyond 1.0.1 and check the plugin's vendor or WPScan advisory for the fix.","search":"'-2026':16A,19A '-87784':17A,20A '1.0.1':43B,81C 'account':66B 'administr':14A,67B,110C 'allow':97C 'authent':99C 'becom':12A 'capabl':53B,86C,93C,111C 'chang':51B 'check':46B,89C 'cool':1A,22A,26B,36B,75C 'cool-media-filt':25B 'cool-media-filter':21A 'cve':15A,18A 'filter':3A,24A,28B,38B,77C 'grant':63B,106C 'host':32B 'includ':59B 'let':6A 'log':9A,56B 'logged-in':8A,55B 'media':2A,23A,27B,37B,76C 'nonc':49B,88C 'packag':29B 'perform':84C 'permiss':47B 'plugin':5A,40B,79C 'right':68B 'role':52B,96C,109C 'self':31B 'self-host':30B 'site':13A,73B,116C 'subscrib':61B,104C 'take':70B,113C 'unmaintain':33B 'updat':91C 'user':11A,58B,100C 'version':42B 'wordpress':4A,34B,39B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Cool Media Filter plugin at version 1.0.1 or earlier are exposed. Any account that can log in, including a basic subscriber account, is enough to escalate privileges. Sites without the plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["coolmediafilter"],"ptokens":["cool","filter","media"],"labels":["coolmediafilter","high","package","selfhosted","unmaintained","wordpress"],"campaign_type":null,"search_a":"'-2026':16A,19A '-87784':17A,20A 'administr':14A 'becom':12A 'cool':1A,22A 'cool-media-filter':21A 'cve':15A,18A 'filter':3A,24A 'let':6A 'log':9A 'logged-in':8A 'media':2A,23A 'plugin':5A 'site':13A 'user':11A 'wordpress':4A","search_b":"'1.0.1':43B 'account':66B 'administr':67B 'capabl':53B 'chang':51B 'check':46B 'cool':26B,36B 'cool-media-filt':25B 'filter':28B,38B 'grant':63B 'host':32B 'includ':59B 'log':56B 'logged-in':55B 'media':27B,37B 'nonc':49B 'packag':29B 'permiss':47B 'plugin':40B 'right':68B 'role':52B 'self':31B 'self-host':30B 'site':73B 'subscrib':61B 'take':70B 'unmaintain':33B 'user':58B 'version':42B 'wordpress':34B,39B","search_c":"'1.0.1':81C 'administr':110C 'allow':97C 'authent':99C 'capabl':86C,93C,111C 'check':89C 'cool':75C 'filter':77C 'grant':106C 'media':76C 'nonc':88C 'perform':84C 'plugin':79C 'role':96C,109C 'site':116C 'subscrib':104C 'take':113C 'updat':91C 'user':100C 'wordpress':78C","first_public_at":"2026-11-06T06:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87784","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87784","severity":null,"published_at":"2026-11-06T06:16:44+00:00","modified_at":"2026-11-06T06:16:44+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87784:1868","url":"https://wordpress.org/plugins/cool-media-filter/","severity":null,"published_at":"2026-11-06T06:44:27+00:00","modified_at":"2026-11-06T06:44:27+00:00","first_seen_at":"2026-11-06T06:44:27+00:00","fetched_at":"2026-11-06T06:44:27+00:00","note":"NVD page returned no text; WordPress.org plugin page shows 1.0.1 is the latest release, last updated 2018, fewer than 10 installs, so no fix exists beyond 1.0.1. No WPScan/vendor advisory found. Nothing verified (no vendor statement of no-fix). Exploitation/PoC not found.","cites":["https://wordpress.org/plugins/cool-media-filter/","https://nvd.nist.gov/vuln/detail/CVE-2026-87784"]}],"documents":[{"id":84170,"url":"https://wordpress.org/plugins/cool-media-filter/","title":"Cool Media Filter – WordPress.org plugin page","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":84171,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87784","title":"NVD CVE-2026-87784","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}