Unrated severityNVD Advisory· Published Oct 7, 2026
CVE-2026-87782
CVE-2026-87782
Description
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
Affected products
2<1.1.5+ 1 more
- (no CPE)range: <1.1.5
- (no CPE)range: <1.1.5
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.