CVE-2026-87759: Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Add User Autocomplete WordPress pluginto a version that resolves this vulnerability.Fixed in 1.2 - Compensating control
On the affected WordPress multisite installation, ensure only trusted users can access functionality that creates site-membership invitations (limit access to any admin/user management endpoints or UI elements that could be abused for role assignment).
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
The issue affects WordPress multisite installations using Add User Autocomplete versions before 1.2. It relies on the plugin's site-membership invitation functionality.
What level of access does an attacker need?
An attacker only needs an authenticated WordPress account. A low-privileged account such as a subscriber can create a pending invitation with the administrator role assigned.
Are additional security checks required before exploitation?
No capability or nonce check is performed before the pending membership invitation is created. The caller can supply the role value, including administrator.