wp_roster vulnerabilities
CVEs whose affected-version data names the wp_roster package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-115257Medium· 5.3WP Roster < 2.36 - Unauthenticated Roster Data Modification
The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.
▾ SunlitEPSS 0.22%via CVEORG
CVE-2026-115255Medium· 5.3WP Roster < 2.35 - Unauthenticated Roster Member Deletion
The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.
▾ SunlitEPSS 0.23%via CVEORG