CVE-2026-87782

HIGHCVSS 8.8

Description

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.

Timeline

Published:October 7th, 2026 7:17 AM

Last modified:October 7th, 2026 2:52 PM

CVSS Scoring

CVSS v3: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-269

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/0f3af398-4a70-4987-9da8-b876b9e932c7/

Source: NIST NVD · Data may lag official sources by up to one minute