8.8
High
CVE-2026-87759 The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a…
Description
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Add User Autocomplete 1.2 | earliest → < 1.2 | 1.2 |