CVE-2026-87828

Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).

Affected

Seraphinite Accelerator

CVSS v3.1 CNA

5.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

EPSS

0.32% chance of exploitation in the next 30 days, 23rd percentile

Published

2026-09-16

Updated

2026-09-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ce546b34-4383-4166-9b87-335a524f37e2/

References

• CVE Record
• NVD entry