CVEvulnerability

CVE-2026-8157

8.8 HIGH Published 2026-06-22 Modified 2026-06-22 Official page ↗
Status
Deferred
Published
2026-06-22
Last modified
2026-06-22
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269

Description

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.

Related

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References