What is GHSA-hq2m-9p82-5366?

GHSA-hq2m-9p82-5366 is a security advisory published by GitHub Security Advisories with High severity. The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be...

Which CVE IDs does GHSA-hq2m-9p82-5366 cover?

GHSA-hq2m-9p82-5366 covers the following CVE IDs: CVE-2026-8157. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hq2m-9p82-5366?

GHSA-hq2m-9p82-5366 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-hq2m-9p82-5366HighCVSS 8.8

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be...

Vendor

GitHub Security Advisories

Published

June 22, 2026

Last Modified

June 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-8157 →

📋 Description

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-8157
https://wpscan.com/vulnerability/6680cc6a-9758-4040-bb39-7b9545041dc3
https://github.com/advisories/GHSA-hq2m-9p82-5366