Unauthorized Data Manipulation in WP Roster Plugin for WordPress
CVE-2026-115257
Key Information:
Badges
What is CVE-2026-115257?
The WP Roster plugin for WordPress prior to version 2.36 contains a significant security vulnerability that allows unauthenticated users to access and manipulate stored roster data. By bypassing necessary capability checks and nonce verification, attackers can overwrite, erase, or restore any roster content. This lack of protection poses a serious risk to the integrity of users' data. Site administrators are urged to update to the latest version to mitigate this risk and ensure the continued security of their WordPress installations.
Affected Version(s)
WP Roster 0 < 2.36
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.