Unscored severity · published Oct 28, 2026
CVE-2026-115255
WP Roster < 2.35 - Unauthenticated Roster Member Deletion
New
–
CVSS
–
EPSS
No
On KEV
Description
The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WR
WP Roster ·
before 2.35 · source: vendor