Vulnerability in Add User Autocomplete Plugin for WordPress by the Developer
CVE-2026-87759
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 September 2026
Badges
What is CVE-2026-87759?
The Add User Autocomplete plugin for WordPress versions prior to 1.2 is susceptible to improper access control. It fails to verify capabilities or nonce checks before allowing the creation of a pending site-membership invitation with a role provided by the user. This vulnerability enables any authenticated user, including those with limited permissions such as subscribers, to assign themselves elevated roles, such as administrator, in a multisite setup. Proper validation and restrictions are essential to prevent this unauthorized role escalation, which can compromise the security of the entire WordPress network.
Affected Version(s)
Add User Autocomplete 0 < 1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.