What is the CVSS score of CVE-2026-4297?

CVE-2026-4297 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Welcome Software Publishing are affected by CVE-2026-4297?

The Welcome Software Publishing WordPress plugin (versions ≤0.0.31) contains a privilege escalation vulnerability allowing any authenticated user with subscriber-level access to escalate privileges…

How to fix or mitigate CVE-2026-4297?

Within 24 hours: Disable and remove the Welcome Software Publishing plugin immediately; audit all administrator accounts for unauthorized additions created via XML-RPC; analyze web server and WordPress logs for nc.setOption calls. Within 7 days: Complete forensic review of WordPress options and user creation logs since plugin installation; reset all administrative credentials; enable multi-factor authentication for all admin accounts; document any unauthorized option changes. Within 30 days: Identify and deploy alternative publishing solution if required; implement XML-RPC access restrictions at the firewall or web application layer; configure WordPress to restrict user registration to pre-approved email addresses only.

Welcome Software Publishing CVE-2026-4297

EUVD-2026-38664 HIGH

Missing Authorization (CWE-862)

2026-06-24 Wordfence

GHSA-xgj6-m977-pghj

WordPress Authentication Bypass Privilege Escalation Wordpress Plugin Welcome Software Publishing

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable XML-RPC endpoint, low complexity, requires any authenticated Subscriber (PR:L), no UI; arbitrary options update yields full admin takeover so C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:53 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

HIGH 8.8

DescriptionCVE.org

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authorization check such as current_user_can('manage_options'). This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary WordPress options via XML-RPC requests. This can be leveraged to change the default_role option to 'administrator' and then register a new administrator account, achieving full privilege escalation and site takeover.

Articles & Coverage 1

News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Privilege escalation in the Welcome Software Publishing WordPress plugin (versions ≤ 0.0.31) allows any authenticated user with Subscriber-level access or above to update arbitrary WordPress options via the nc.setOption XML-RPC method. By modifying the default_role option to 'administrator' and registering a new account, attackers achieve full site takeover. No public exploit identified at time of analysis, but the attack pattern is trivial and well-documented for similar WordPress XML-RPC missing-capability flaws.

Technical ContextAI

The vulnerability resides in the newscred-publishing plugin's nc_setOption() handler, registered as the XML-RPC method nc.setOption. The function calls $wp_xmlrpc_server->login() to authenticate the caller's credentials but omits any authorization check such as current_user_can('manage_options') before invoking WordPress's update_option(). This is a textbook CWE-862 (Missing Authorization) flaw: authentication confirms identity, but no role/capability gate restricts which users may invoke the privileged action. The affected CPE is cpe:2.3:a:newscred:welcome_software_publishing covering all versions through 0.0.31, distributed via the WordPress.org plugin repository.

RemediationAI

No vendor-released patch identified at time of analysis - no fix version is listed in the available references, only the vulnerable 0.0.31 source. Until a patched release is published, deactivate and remove the newscred-publishing plugin entirely, as it appears unmaintained and provides direct privilege-escalation primitives. Compensating controls if removal is not immediately feasible: disable XML-RPC site-wide (e.g., via 'add_filter("xmlrpc_enabled", "__return_false")' or by blocking /xmlrpc.php at the web server / WAF), which breaks legacy XML-RPC clients including some mobile apps and Jetpack features; disable open user registration in WordPress Settings → General (closes the Subscriber-onboarding path but blocks legitimate signups); and audit existing low-privilege accounts and the default_role option for tampering. Monitor wordfence.com for an updated advisory at the URL above.