Privilege Escalation Vulnerability in CourseCure Courses Plugin by WordPress

CVE-2026-15309

What is CVE-2026-15309?

The CourseCure Courses plugin for WordPress contains a privilege escalation vulnerability that allows authenticated users with subscriber-level access to escalate their privileges unchecked. This arises from a flaw in the ajax_save_settings() function where missing capability checks allow attackers to manipulate the update_option() function using arbitrary POST parameters. By changing the default WordPress role to 'administrator' and enabling user registration, an attacker may register a new account with full administrative privileges. This serious security flaw necessitates prompt updates to safeguard user accounts and site integrity.

References