CVE-2026-85681

WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update

View on CVE.org
Published Sep 12, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.

Analysis

AI-generated

Technical impact

The WP Component WordPress plugin up to version 2.2.4 fails to enforce capability or nonce checks on one of its actions. This is a CWE-269 vulnerability, representing improper privilege management. The plugin accepts both the option name and value from the request, allowing an unauthenticated user to modify any site option. On a standalone site this can be leveraged to enable user registration with a full site takeover.

Affected Systems

Any WordPress site running the WP Component plugin version 2.2.4 or earlier. The vulnerability is vendor‑agnostic beyond the plugin and affects all sites that have installed the plugin.

Risk and Exploitability

The CVSS score is 9.8, reflecting a high‑severity remote vulnerability. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. Lack of authentication checks indicates a high potential to gain administrator privileges. An attacker with web access can submit a crafted request to overwrite critical options. Because the exploit requires no credentials, the attack can be performed from any internet‑connected client, enabling full site takeover on single‑site installations.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest WP Component plugin version that includes the fix for arbitrary option updates
  • Use a web application firewall or security plugin to block unauthenticated requests that attempt to modify site options
  • Disable user registration or change the default role for new users to a non‑administrator role

Generated by OpenCVE AI on September 15, 2026 at 19:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions wp Component
Vendors & Products Wordpress-extensions
Wordpress-extensions wp Component
Type Values Removed Values Added
Weaknesses CWE-284
CWE-640
Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-284
CWE-640
Type Values Removed Values Added
Description The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
Title WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update
References
Weaknesses
  • CWE-269

    Improper Privilege Management

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Sep 12, 2026, 3:30 PM
Reserved
Sep 4, 2026, 1:41 PM

View source JSON

Updated
Sep 12, 2026, 3:18 PM

JSON

Status
Deferred
Published
Sep 12, 2026, 6:16 AM
Modified
Sep 14, 2026, 9:10 PM

View source JSON

No data.

Updated
Nov 13, 2026, 12:39 PM

JSON