EUVD-2026-76798
GHSA-2x96-8ghm-3875
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain any WordPress account
-
DeliveryAuthenticate to multisite network
-
ExploitSend crafted invitation request with role=administrator
-
ExecutionPlugin creates invitation without capability check
-
PersistAccept pending invitation
-
ImpactAchieve site administrator privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress session at any privilege level - subscriber or above is sufficient; no elevated role is needed. Exploitation is strictly limited to WordPress multisite installations; single-site WordPress deployments are completely unaffected since the site-membership invitation mechanism is a multisite-only feature. The Add User Autocomplete plugin must be installed and active (any version before 1.2). No non-default configuration is required beyond these conditions. Open user registration on the multisite further lowers the barrier, as attackers could self-register before escalating. |
| Impact | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the technical severity: network-reachable, low complexity, requiring only a subscriber account, with full confidentiality/integrity/availability impact upon successful admin takeover. Real-world risk is bounded by deployment footprint - this is a niche plugin with no evidence of wide adoption, no KEV listing, and an EPSS of 0.13% at the 3rd percentile, indicating negligible observed exploitation activity. However, the absence of any authentication-level barrier beyond 'has a WordPress account' means any multisite with open registration is exposed to unauthenticated-equivalent risk in practice. Single-site WordPress installations are not affected. The patch (version 1.2) is available, making continued exposure purely a patching-lag risk. No CVSS/description contradictions detected. |
| Exploit ScenarioDerived | An attacker with a subscriber-level WordPress account on a multisite network sends a crafted POST request to the plugin's invitation endpoint, setting the role parameter to 'administrator'. Because no capability or nonce check occurs, the plugin creates a pending site-membership invitation with administrator privileges. The attacker then accepts the invitation, gaining full administrative control over the target site within the multisite network. No public POC has been identified, but the attack requires only knowledge of the vulnerable endpoint and an authenticated session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 12, 2026
Privilege escalation in the Add User Autocomplete WordPress plugin before 1.2 allows any authenticated user - including subscribers - to self-assign the administrator role on a WordPress multisite installation by submitting a crafted site-membership invitation request with an attacker-controlled role parameter. The plugin performs no capability check (no current_user_can()) and no nonce validation before accepting and creating the invitation, making the attack trivial for any account holder. No public exploit or CISA KEV listing is identified at time of analysis; EPSS sits at 0.13% (3rd percentile), but the low barrier (subscriber-level auth) makes any multisite deployment with this plugin a meaningful lateral escalation risk.
RemediationAI
Update the Add User Autocomplete plugin to version 1.2 or later, which introduces proper capability and nonce validation before processing site-membership invitations. The fix is available through the standard WordPress plugin update mechanism and the WordPress.org repository. Reference the WPScan advisory at https://wpscan.com/vulnerability/41020730-c79a-43b4-a902-3a34fdca90d6/ for confirmation. If immediate patching is not feasible, the most effective compensating control is to deactivate the plugin entirely - this removes all attack surface at the cost of losing the autocomplete functionality. Restricting WordPress registration to prevent new low-privilege accounts reduces the attacker pool but does not protect against existing low-privilege users. Network-level controls provide no meaningful mitigation since any authenticated session is sufficient to exploit the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Add User Autocomplete plugin provides user-search autocomplete for WordPress multisite networks. The vulnerability (CWE-269: Improper Privilege Management) resides in the invitation-creation code path: the plugin accepts a caller-supplied role parameter and creates a pending site-membership invitation without first calling current_user_can() to verify the requester holds a role entitled to assign the specified privilege level, and without verifying a WordPress nonce to prevent cross-site request forgery abuse. This is a standard WordPress authorization anti-pattern where capability enforcement is skipped entirely. Affected versions are confirmed as all releases below 1.2 per the EUVD entry (EUVD-2026-76798). No CPE string was provided; the product maps to the 'add-user-autocomplete' plugin slug in the WordPress.org repository.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects minimum subscriber-level auth; AV:N for web-delivered request; C/I/A:H for full site admin takeover; S:U as impact stays within the exploited site.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
Executive ViewAI
The Add User Autocomplete WordPress plugin before version 1.2 exposes multisite WordPress deployments to a critical privilege escalation risk: any subscriber account can unilaterally grant itself full administrator access without authorization checks or verification. For organizations managing multiple WordPress sites, this transforms user account compromise into a platform-wide administrative takeover.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB