Skip to content
Sign in
5.3 Medium

CVE-2026-115257 WP Roster < 2.36 - Unauthenticated Roster Data Modification

Description

The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
WP Roster 2.36 earliest → < 2.36 2.36

Other CVEs of WP Roster

The 2 CVEs of WP Roster →
CVE-2026-115255 The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions,… 5.3 Medium
Track this CVE