Koinonia Link CVE-2026-87782

Requires an authenticated account of any privilege level (e.g., subscriber) on a WordPress site running the Koinonia Link plugin version 1.1.2 through earlier than 1.1.5, and reachability of the plugin's profile-update/role-save functionality. There is no special non-default configuration needed and no user interaction required (UI:N). The one meaningful limiting factor is the need for a valid low-privileged account: sites with open/self-service user registration enabled are exposed to anonymous attackers who simply register, whereas sites with registration disabled restrict this to users who already possess an account.

This is a genuine high-priority issue rather than an inflated CVSS score. The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: a network-reachable, low-complexity privilege-escalation flaw requiring only a low-privileged authenticated account and no user interaction. The description (CWE-269, missing authorization on role selection during profile update) directly supports the PR:L and full C/I/A:H impact, since gaining the Administrator role yields complete control of the WordPress site. A public exploit is reported available (via WPScan), which raises practical risk, and a vendor patch (1.1.5) exists. No EPSS score, SSVC decision data, or CISA KEV entry was provided in the input, so exploitation probability and automatability cannot be quantified and there is no confirmation of active in-the-wild exploitation - only that exploit code exists. The main real-world mitigating factor is the prerequisite of an existing authenticated (even subscriber-level) account, which is trivially satisfied on sites permitting open user registration but is a barrier on closed sites. Overall: a legitimately serious, easily exploitable privilege escalation, tempered chiefly by the obscurity/low deployment of the affected plugin rather than by technical difficulty.

An attacker registers (or already holds) a low-privilege account such as a subscriber on a WordPress site running Koinonia Link before 1.1.5. They submit a profile-update request that includes a role-selection parameter setting their role to Administrator; because the plugin never verifies the user is permitted to change roles, the elevated role is saved. A public exploit for this flaw is reported available, lowering the skill required.