CVE-2026-115257

Full vulnerability record from the local CVENow database.

Description

The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-04 06:17:01.813000

Last modified

2026-11-04 06:17:01.813000

View original CVE JSON

{
  "id": "CVE-2026-115257",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-04T06:17:01.813",
  "lastModified": "2026-11-04T06:17:01.813",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "WP Roster",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.36",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/9edf44aa-e528-4ac3-afea-a4f4451b7e1d/",
      "source": "[email protected]"
    }
  ]
}