{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115257", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-10-22T08:42:48.593Z", "datePublished": "2026-11-04T06:00:27.201Z", "dateUpdated": "2026-11-04T06:00:27.201Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-04T06:00:27.201Z"}, "title": "WP Roster < 2.36 - Unauthenticated Roster Data Modification", "problemTypes": [{"descriptions": [{"description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "WP Roster", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "2.36"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster."}], "references": [{"url": "https://wpscan.com/vulnerability/9edf44aa-e528-4ac3-afea-a4f4451b7e1d/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Erwan LR (WPScan)", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Roster", "vendor": "Unknown", "versions": [{"lessThan": "2.36", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster."}], "id": "CVE-2026-115257", "lastModified": "2026-11-04T06:17:01.813", "metrics": {}, "published": "2026-11-04T06:17:01.813", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/9edf44aa-e528-4ac3-afea-a4f4451b7e1d/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{}