WP Roster CVE-2026-115255

No special conditions - remote unauthenticated exploitation against default configurations of the WP Roster plugin, provided it is installed and active at a version before 2.35. The vulnerable AJAX action performs no capability or nonce check, so no authentication, privilege, or user interaction is required. What limits impact: the confirmed effect is restricted to deleting the WordPress user accounts of roster members (I:L; no data disclosure or broader system compromise per the vector), and exploitation requires that the site actually runs this plugin with roster-member user accounts present.

Signals are mostly consistent and point to a real but moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction - PR:N confirms unauthenticated access per the vector. However, the impact is deliberately scoped low (C:N/I:L/A:N, base 5.3): the only confirmed effect is deletion of the WordPress user accounts of roster members, not full site compromise. The EPSS score is low (0.15%, 4th percentile), the CVE is NOT listed in CISA KEV, and no exploit code is referenced, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', which aligns the low EPSS and absent active-exploitation signal with the easy, unauthenticated trigger - meaning this should be remediated on a normal monthly cadence, not treated as act_now/emergency. One nuance worth verifying: NVD models account deletion as an integrity impact (I:L) rather than availability, which is defensible but means the operational effect (loss of access for deleted users) may feel more like an availability problem to affected sites.

An attacker who can reach the WordPress site sends an unauthenticated request to the vulnerable WP Roster AJAX action, which performs no capability or nonce verification, and specifies a roster member's account for deletion. Because no login, token, or user interaction is needed, the request succeeds against any site running the plugin before 2.35. No public exploit code is referenced, so an attacker would craft the request from the plugin's AJAX handler details.