CVE-2026-115255 in WP Roster Plugin
Summary
by MITRE • 10/28/2026
The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in versions of the WP Roster plugin prior to version 2.35 represents a critical failure in access control mechanisms within a widely used WordPress ecosystem component. This flaw specifically affects an AJAX action endpoint that is designed to manage roster member data but lacks the necessary security validations required for state-changing operations. In secure web application development, particularly within content management systems like WordPress, any operation that modifies server-side state or deletes persistent data must be protected by robust authentication and authorization checks. The absence of these controls in this specific plugin functionality creates a direct pathway for unauthenticated actors to interact with the backend logic without possessing valid credentials or session tokens.
From a technical perspective, the core issue lies in the missing implementation of capability verification and nonce validation during the processing of AJAX requests. Capability checks ensure that the user initiating the request possesses the appropriate permissions defined by the application's role hierarchy, such as administrator or editor privileges. Nonce validation, short for number used once, serves to prevent Cross-Site Request Forgery attacks by ensuring that the request originated from a legitimate form submission initiated by an authenticated user within their active session window. By omitting these checks, the plugin effectively treats any HTTP POST request targeting this endpoint as valid and authorized, regardless of whether it comes from a logged-in administrator or an anonymous visitor accessing the site via a web browser or automated script.
The operational impact of this vulnerability is severe, primarily due to its potential for data destruction and disruption of service. An unauthenticated attacker can exploit this flaw to delete user accounts associated with roster members. In many use cases involving sports teams, clubs, or organizational directories managed by WP Roster, these user accounts may contain sensitive personal information, contact details, and historical performance data. The deletion of such records leads to irreversible loss of critical business intelligence and member history. Furthermore, the ability to remove users can disrupt ongoing communications, invalidate existing login credentials for legitimate members who are forced to re-register, and cause significant administrative overhead as site owners attempt to restore lost accounts or manage the resulting chaos in user management interfaces.
This vulnerability aligns with CWE-862, which describes Missing Authorization, indicating that the software does not perform an authorization check when an actor attempts to access a resource or perform an action. Additionally, it maps to ATT&CK technique T1059, specifically Command and Scripting Interpreter sub-techniques if exploited via automated scripts, but more accurately fits within the broader category of unauthorized data modification under initial access and persistence vectors depending on how the deletion is leveraged for further exploitation. The lack of nonce validation also exposes the application to CWE-352, Cross-Site Request Forgery (CSRF), allowing attackers to craft malicious links or forms that trigger the delete action when a victim with valid privileges visits them, although in this specific case, the absence of capability checks means even unauthenticated users can directly execute the deletion without needing to trick an admin.
To mitigate this vulnerability and prevent similar issues in future updates, developers must enforce strict input validation and access control on all AJAX endpoints that modify data. This involves implementing WordPress-specific security functions such as check_admin_referer or wp_verify_nonce to validate request origins and current_user_can with appropriate capability strings to ensure the requester has permission to perform user deletion operations. Additionally, enabling two-factor authentication for administrative accounts adds a layer of defense-in-depth against credential theft which could otherwise be used to exploit similar flaws if they existed elsewhere in the plugin. Site administrators running affected versions should immediately update WP Roster to version 2.35 or later where these security controls have been properly implemented and tested.