blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-85681

CRITICAL 9.8 CVSS 3.1
Published
September 12, 2026
Last modified
September 14, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-269
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.

Affected products and versions

  • Unknown WP Component — Up to and including 2.2.4

References

  • wpscan.com https://wpscan.com/vulnerability/c602bd9e-a825-4990-a66b-1403bbeb2cee/
  • nvd.nist.gov Official NVD record