Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-87759: Add User Autocomplete plugin lets users grant admin role
CVE-2026-87759 · published 1 month ago
Summary
The Add User Autocomplete add‑on for WordPress multisite does not check a user’s permissions before it creates an invitation that includes a role you choose. Because of this, even a low‑privilege user can assign themselves the administrator role. Update the plugin to version 1.2 or later, or remove it, to stop this from happening.
What to do
- Update unknown add user autocomplete to version 1.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | add user autocomplete | < 1.2 |
Original advisory text
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing a...
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-269Improper Privilege Management
Timeline
Published12 Sep 2026
Updated4 Nov 2026
First seen12 Sep 2026
Track software like this
Free during beta