CVE-2026-87784

Full vulnerability record from the local CVENow database.

Description

The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-06 06:16:44.363000

Last modified

2026-11-06 06:16:44.363000

View original CVE JSON

{
  "id": "CVE-2026-87784",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T06:16:44.363",
  "lastModified": "2026-11-06T06:16:44.363",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Cool Media Filter",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/16788a03-d95b-4675-868a-dd56cc3365b6/",
      "source": "[email protected]"
    }
  ]
}