high8.8
CVE-2026-87759
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carry…
Impact
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
Affected products
| Product | Affected versions |
|---|---|
| Add User Autocomplete WordPress Plugin | before 1.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.