{"id":"CVE-2026-115257","title":"WP Roster < 2.36 - Unauthenticated Roster Data Modification","summary":"The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"adp","cwe":["CWE-284"],"product":"WP Roster","affected":["wp_roster < 2.36"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-04T14:02:53.646985Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:18:20.378Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115257","references":[{"url":"https://wpscan.com/vulnerability/9edf44aa-e528-4ac3-afea-a4f4451b7e1d/"}],"tags":["cve.org"],"epss":0.00221,"epssPercentile":0.1274,"ingestedAt":"2026-11-05T21:36:00.364Z","slug":"CVE-2026-115257","body":"## Overview\n\nThe WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.\n\n## Affected\n\n- `wp_roster < 2.36`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}