Description
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
Published: 2026-09-12
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Update
AI Analysis

Impact

The WP Component WordPress plugin up to version 2.2.4 fails to enforce capability or nonce checks on one of its actions. This is a CWE-269 vulnerability, representing improper privilege management. The plugin accepts both the option name and value from the request, allowing an unauthenticated user to modify any site option. On a standalone site this can be leveraged to enable user registration with a full site takeover.

Affected Systems

Any WordPress site running the WP Component plugin version 2.2.4 or earlier. The vulnerability is vendor‑agnostic beyond the plugin and affects all sites that have installed the plugin.

Risk and Exploitability

The CVSS score is 9.8, reflecting a high‑severity remote vulnerability. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. Lack of authentication checks indicates a high potential to gain administrator privileges. An attacker with web access can submit a crafted request to overwrite critical options. Because the exploit requires no credentials, the attack can be performed from any internet‑connected client, enabling full site takeover on single‑site installations.

Generated by OpenCVE AI on September 15, 2026 at 19:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest WP Component plugin version that includes the fix for arbitrary option updates
  • Use a web application firewall or security plugin to block unauthenticated requests that attempt to modify site options
  • Disable user registration or change the default role for new users to a non‑administrator role

Generated by OpenCVE AI on September 15, 2026 at 19:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-640

Sat, 12 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 12 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-640

Sat, 12 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Description The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
Title WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-12T15:30:57.415Z

Reserved: 2026-09-04T13:41:04.569Z

Link: CVE-2026-85681

cve-icon Vulnrichment

Updated: 2026-09-12T15:18:33.760Z

cve-icon NVD

Status : Deferred

Published: 2026-09-12T06:16:27.250

Modified: 2026-09-14T21:10:17.423

Link: CVE-2026-85681

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T19:45:07Z

Weaknesses
  • CWE-269

    Improper Privilege Management