CVE-2026-15309: CourseCure Courses <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint
The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajaxsavesettings() function, which accepts arbitrary POST parameters and calls updateoption() with attacker-controlled keys and values without any authorization verification. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges to administrator by setting the defaultrole WordPress option to 'administrator' and userscanregister to '1', then registering a new account that is automatically granted full administrator access.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. No user interaction is required.
Are sites affected under a default WordPress configuration?
Exploitation depends on the attacker being able to authenticate as a Subscriber or higher. The described escalation changes the default registration role and enables registration, then uses a newly registered account to obtain administrator access.
What can be done if the plugin cannot be patched immediately?
Limit or remove Subscriber-level and other untrusted authenticated accounts, and monitor for unauthorized changes to the default_role and users_can_register WordPress options. Review newly created accounts for unexpected administrator privileges.
How can I tell whether exploitation may have occurred?
Check whether the default_role option has been changed to administrator and whether users_can_register has been enabled unexpectedly. Also review user registrations and administrator accounts created without authorization.