---
id: CVE-2026-115255
title: WP Roster < 2.35 - Unauthenticated Roster Member Deletion
summary: >-
  The WP Roster WordPress plugin before 2.35 does not perform any capability or
  nonce checks on one of its AJAX actions, allowing unauthenticated attackers to
  delete the WordPress user accounts of roster members.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-284
product: WP Roster
affected:
  - wp_roster < 2.35
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T17:40:45.934509Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:58:04.092Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115255'
references:
  - url: 'https://wpscan.com/vulnerability/af573c89-e246-4c52-bd15-fa92c317c263/'
tags:
  - cve.org
epss: 0.00231
epssPercentile: 0.14001
ingestedAt: '2026-10-28T07:06:27.132Z'
---

## Overview

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.

## Affected

- `wp_roster < 2.35`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.