CVE-2026-115255: WP Roster < 2.35 - Unauthenticated Roster Member Deletion

Q: Who can exploit this issue?

An unauthenticated attacker can exploit the affected AJAX action; no WordPress account, capability, or valid nonce is required.

Q: Which accounts are at risk of deletion?

The issue allows deletion of WordPress user accounts belonging to roster members. The provided information does not establish that non-roster user accounts can be deleted.

Q: Are installations running version 2.35 affected?

The issue is described as affecting WP Roster versions before 2.35. Version 2.35 is not identified as affected in the provided data.

Published Oct 28, 2026

Updated

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.

Affected Software

1 affected component

WP Roster<2.35

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit the affected AJAX action; no WordPress account, capability, or valid nonce is required.

Which accounts are at risk of deletion?

The issue allows deletion of WordPress user accounts belonging to roster members. The provided information does not establish that non-roster user accounts can be deleted.

Are installations running version 2.35 affected?

The issue is described as affecting WP Roster versions before 2.35. Version 2.35 is not identified as affected in the provided data.

CVE-2026-115255: WP Roster < 2.35 - Unauthenticated Roster Member Deletion

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which accounts are at risk of deletion?

Are installations running version 2.35 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which accounts are at risk of deletion?

Are installations running version 2.35 affected?