CVE-2026-87759

Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.

Affected

Add User Autocomplete

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2026-09-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/41020730-c79a-43b4-a902-3a34fdca90d6/

References

• CVE Record
• NVD entry