What is GHSA-j835-2vx3-j669?

GHSA-j835-2vx3-j669 is a security advisory published by GitHub Security Advisories with Medium severity. The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one...

Which CVE IDs does GHSA-j835-2vx3-j669 cover?

GHSA-j835-2vx3-j669 covers the following CVE IDs: CVE-2026-115255. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j835-2vx3-j669?

GHSA-j835-2vx3-j669 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-j835-2vx3-j669MediumCVSS 5.3

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one...

Vendor

GitHub Security Advisories

Published

October 28, 2026

Last Modified

October 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-115255 →

📋 Description

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-115255
https://wpscan.com/vulnerability/af573c89-e246-4c52-bd15-fa92c317c263
https://github.com/advisories/GHSA-j835-2vx3-j669