medium5.3
CVE-2026-115255
The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to de…
Impact
The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.
Affected products
| Product | Affected versions |
|---|---|
| WP Roster WordPress Plugin | before 2.35 |
Versions were read from the advisory text. No structured product data has been published for this record yet.