CVE-2026-85681: WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Component WordPress pluginto a version that resolves this vulnerability.Fixed in 2.2.4
Event History
Frequently Asked Questions
Which deployments are explicitly known to be at risk of full site takeover?
Single-site WordPress installations using the affected plugin are explicitly described as susceptible to full takeover. The attack can enable registration and set the default role to administrator.
Does exploitation require an authenticated WordPress account or user interaction?
No. The affected action is available to unauthenticated users and lacks both capability and nonce checks.
What is the immediate risk if the plugin cannot be updated yet?
An unauthenticated attacker can overwrite arbitrary site options through the vulnerable action. On a single-site installation, this can be used to enable registration and create an administrator-level account.