newscred Welcome Software Publishing Plugin up to 0.0.31 on WordPress Options Update nc_setOption wp_xmlrpc_server authorization

Summaryinfo

A vulnerability has been found in newscred Welcome Software Publishing Plugin up to 0.0.31 on WordPress and classified as critical. This vulnerability affects the function nc_setOption of the component Options Update Handler. The manipulation of the argument wp_xmlrpc_server leads to authorization. This vulnerability is referenced as CVE-2026-4297. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in newscred Welcome Software Publishing Plugin up to 0.0.31 on WordPress and classified as critical. This issue affects the function nc_setOption of the component Options Update Handler. The manipulation of the argument wp_xmlrpc_server with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authorization check such as current_user_can('manage_options'). This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary WordPress options via XML-RPC requests. This can be leveraged to change the default_role option to 'administrator' and then register a new administrator account, achieving full privilege escalation and site takeover.

The weakness was published by Nabil Irawan. The advisory is shared at wordfence.com. The identification of this vulnerability is CVE-2026-4297 since 03/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 0.0.31 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• newscred

Name

• Welcome Software Publishing Plugin

Version

• 0.0.1
• 0.0.2
• 0.0.3
• 0.0.4
• 0.0.5
• 0.0.6
• 0.0.7
• 0.0.8
• 0.0.9
• 0.0.10
• 0.0.11
• 0.0.12
• 0.0.13
• 0.0.14
• 0.0.15
• 0.0.16
• 0.0.17
• 0.0.18
• 0.0.19
• 0.0.20
• 0.0.21
• 0.0.22
• 0.0.23
• 0.0.24
• 0.0.25
• 0.0.26
• 0.0.27
• 0.0.28
• 0.0.29
• 0.0.30
• 0.0.31

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion