CVE-2026-115255

WP Roster < 2.35 - Unauthenticated Roster Member Deletion

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.

Affected

WP Roster

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.23% chance of exploitation in the next 30 days, 14th percentile

Published

2026-10-28

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/af573c89-e246-4c52-bd15-fa92c317c263/find archive

CVE references

• https://wpscan.com/vulnerability/af573c89-e246-4c52-bd15-fa92c317c263REFERENCE

References

• CVE Record
• NVD entry