CVE-2026-115257: WP Roster < 2.36 - Unauthenticated Roster Data Modification
The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using WP Roster versions earlier than 2.36 are affected. An attacker can target stored roster data without authenticating.
What access does an attacker need?
No account, capability, or user interaction is required. The attack can be performed remotely over the network with low complexity.
What can an attacker change?
An attacker can overwrite, wipe, or restore the content of any roster stored by the plugin. The reported impact is limited to integrity; no confidentiality or availability impact is specified.
How can I determine whether my site is affected?
Check whether WP Roster is installed and whether its version is earlier than 2.36. Sites running a version before 2.36 should treat roster data as potentially modifiable by unauthenticated parties.