8.8
Élevée
CVE-2026-87759 The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a…
Description
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Add User Autocomplete 1.2 | premières → < 1.2 | 1.2 |