EUVD-2026-76796
GHSA-pjpf-74g9-grmh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running WP Component ≤2.2.4
-
DeliverySend unauthenticated request overwriting registration options
-
ExploitSet default_role to administrator
-
ExecutionSelf-register new account
-
PersistLog in with admin privileges
-
ImpactInstall malicious plugin for full control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable against any single-site WordPress install running WP Component ≤2.2.4 with the plugin active - no authentication, no user interaction, and default configuration suffice, since the vulnerable action is registered for unauthenticated (nopriv) callers and performs no capability or nonce check. The description explicitly ties full takeover to single-site installations relying on the registration/default-role option path; on multisite the takeover route via self-registration may not apply, though arbitrary option overwrite remains possible. The only real limiting factors are the plugin being installed and active and the target being a single-site deployment. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is credible: exploitation is remote, unauthenticated, requires no user interaction, and the described option-overwrite-to-admin path genuinely yields full compromise. The one tension is between the very high CVSS and the low EPSS (0.14%, 3rd percentile), which reflects the plugin's small install base rather than any difficulty of exploitation - the technique itself is trivial and reliable. There is no CISA KEV listing and no POC flag in the input, so this is high-impact-but-not-yet-observed-in-exploitation. Note the description explicitly scopes full takeover to single-site installations; on multisite, registration/role semantics differ and the impact may be reduced, so verify against the target's install topology. |
| Exploit ScenarioDerived | An attacker sends a single crafted unauthenticated POST to the plugin's admin-ajax action, setting option 'users_can_register' to 1 and 'default_role' to 'administrator'. They then register a new account through the normal WordPress signup flow, receive administrator privileges, and log in to install a malicious plugin/theme for full server-side control. No credentials or user interaction are needed and the requests are scriptable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 12, 2026
Unauthenticated site takeover in the WP Component WordPress plugin through version 2.2.4 stems from an AJAX-style action exposed to logged-out users that performs no capability or nonce validation and blindly writes an attacker-supplied option name and value. Because the handler can overwrite arbitrary wp_options entries, an attacker can flip 'users_can_register' on and set 'default_role' to administrator, then self-register an admin account. Reported by WPScan; carries CVSS 9.8 with EPSS 0.14% (3rd percentile) and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis - the advisory describes the plugin as vulnerable 'through 2.2.4' without naming a fixed release. Until a patched version is confirmed, deactivate and remove the WP Component plugin, which fully eliminates the exposed unauthenticated action. If the plugin cannot be removed, block or restrict access to the vulnerable admin-ajax action at a WAF/reverse-proxy layer (filtering the specific action parameter) and, as a hardening step, force 'users_can_register' off and 'default_role' to 'subscriber' via wp-config or code so that even a successful option write cannot silently enable admin registration - though a determined attacker could overwrite other options too, so this is a stopgap, not a fix. Monitor for the WPScan-referenced fix and consult https://wpscan.com/vulnerability/c602bd9e-a825-4990-a66b-1403bbeb2cee/ for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WordPress plugins register callbacks via the admin-ajax.php action hooks, and the wp_ajax_nopriv_ variant intentionally serves unauthenticated requests. Secure handlers must gate destructive operations with check_ajax_referer() (nonce) and current_user_can() (capability) checks. Here the plugin registers a nopriv action that calls update_option() with both key and value taken directly from the request, an instance of CWE-269 (Improper Privilege Management) - though the root cause is more precisely a missing authorization/nonce check (CWE-862/CWE-352). Since wp_options controls sitewide settings including registration policy and default user role, arbitrary option write is equivalent to full administrative control on a single-site install.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated arbitrary option write with no interaction yields full admin takeover, so PR:N/UI:N and C/I/A all High; scope unchanged as impact stays within the WordPress instance.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
Executive ViewAI
Organizations using WP Component plugin version 2.2.4 and earlier risk complete loss of website control to unauthenticated attackers who can establish permanent administrative access without valid credentials. With no vendor patch available, immediate interim mitigation is required to prevent unauthorized site compromise and potential data breach.
No vendor-released patch identified at time of analysis. Interim mitigations: disable user registration (wp-admin Users → Registration settings, or set wp_options users_can_register = 0) if not required for business; restrict wp-admin directory access via Web Application Firewall, IP whitelisting, or authentication gateway; implement comprehensive audit logging for user account creation and WordPress option modifications; audit administrator account list for unauthorized entries; consider relocating WordPress login URL to non-standard path.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB