CVE-2026-87759 — Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation

CVE-2026-87759

Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation PUBLISHED

Description (CNA)

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.

Affected (CNA)

Vendor / product	Versions
Unknown / Add User Autocomplete	affected 0 before 1.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/41020730-c79a-43b4-a902-3a34fdca90d6/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.