Remote Code Execution Vulnerability in WordPress Plugin by WP Component
CVE-2026-85681

Currently unrated

Key Information:

Vendor

WordPress
Status
WP Component
Vendor
CVE Published:
12 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-85681?

The WP Component WordPress plugin prior to version 2.2.4 has a severe security flaw that permits unauthenticated users to execute actions without proper capability or nonce checks. Attackers can manipulate the option name and value from the incoming requests, making it possible to overwrite critical settings on the site. In a single site setup, this breach can potentially lead to a complete site takeover, particularly as it enables registration with admin privileges by default. It's crucial for site administrators to update to the latest version to mitigate this security risk.

Affected Version(s)

WP Component 0 <= 2.2.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-85681 - Proof of Concept

References

https://wpscan.com/vulnerability/c602bd9e-a825-4990-a66b-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini - Claudio Marchesini - Dottor Marc
WPScan
.