Seraphinite Accelerator CVE-2026-87828

Requires an authenticated low-privilege account (Subscriber-level, per PR:L) - realistically obtainable only on sites with open user registration enabled, or by any existing low-privilege user. The Seraphinite Accelerator plugin must be installed and running at a version before 2.29.24, and the vulnerable state-update AJAX action must be reachable (default plugin behavior). The DoS manifests when an administrator subsequently loads any wp-admin page - this is routine and effectively guaranteed rather than a meaningful attacker-controlled prerequisite. Limiting factors: an attacker must have (or be able to create) at least a Subscriber account, so sites that disable public registration and have no untrusted low-priv users are not exposed; impact is confined to the admin area (public site stays online) and is recoverable by resetting the malformed plugin state.

This is a moderate, security-team-actionable but not emergency-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) describes a network-reachable, low-complexity denial of service that requires only low authenticated privilege (PR:L) - critically, a Subscriber, which is a self-registerable role on any WordPress site with open registration. The impact is availability-only (C:N/I:N); no data is read or altered. EPSS is low at 0.17% (7th percentile) and it is NOT on the CISA KEV list, so there is no evidence of widespread automated exploitation. However, a public exploit exists (WPScan), lowering the effort barrier, and the outcome - locking every administrator out of wp-admin - is operationally severe and disruptive, which justifies prompt patching. One signal to reconcile: the vendor vector sets A:H (full availability loss), but the flaw only bricks the admin area while the public-facing site keeps serving, so A:H is defensible only if you treat administrative control loss as total. Also note UI:R in the vendor vector: the 'interaction' is merely an admin loading any admin page, which happens routinely - so this is effectively self-triggering and UI:R understates realistic exploitability (see assessed vector, where I use UI:N).

An attacker registers or obtains a low-privilege Subscriber account on a target WordPress site, then sends a single crafted AJAX request to the vulnerable state-update action, which lacks a capability check, writing a malformed value into plugin state. The next time any administrator loads a wp-admin page, an uncaught error fires and the entire admin area becomes inaccessible to all administrators. A public proof-of-concept is available via WPScan, so the technical barrier is low.