CVE-2026-115257

CVE-2026-115257CVE-2026-115257

Description

The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Last modified2026-11-04
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.