---
id: CVE-2026-115257
title: WP Roster < 2.36 - Unauthenticated Roster Data Modification
summary: >-
  The WP Roster WordPress plugin before 2.36 does not perform any capability or
  nonce checks before writing its stored roster data, allowing unauthenticated
  attackers to overwrite, wipe or restore the content of any roster.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-284
product: WP Roster
affected:
  - wp_roster < 2.36
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T14:02:53.646985Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:20.378Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115257'
references:
  - url: 'https://wpscan.com/vulnerability/9edf44aa-e528-4ac3-afea-a4f4451b7e1d/'
tags:
  - cve.org
epss: 0.00221
epssPercentile: 0.1274
ingestedAt: '2026-11-05T21:36:00.364Z'
---

## Overview

The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.

## Affected

- `wp_roster < 2.36`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.