Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-85681: WP Component plugin lets anyone change site settings
CVE-2026-85681 · published 1 month ago
Summary
The WP Component plugin for WordPress (versions up to 2.2.4) lets anyone visiting the site change important configuration options because it does not verify who is making the change. A visitor could turn on registration and give themselves admin rights, giving them full control of the website. Update the plugin to a newer version or remove it and replace it with a secure alternative, and ensure only trusted users can modify site settings.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | wp component | <= 2.2.4 |
Original advisory text
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and...
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-269Improper Privilege Management
Timeline
Published12 Sep 2026
Updated11 Oct 2026
First seen12 Sep 2026
Track software like this
Free during beta