WordPress Plugin Allows Unauthenticated Role Escalation

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Add User Autocomplete WordPress plugin before version 1.2 contains a critical privilege escalation vulnerability that allows any authenticated user—even those with minimal permissions like subscribers—to grant themselves administrator access on multisite WordPress installations. The flaw stems from missing capability and nonce validation when processing site-membership invitations, meaning the plugin fails to verify both that the requesting user has permission to perform the action and that the request originated from a legitimate session. This vulnerability is particularly dangerous because WordPress multisite environments are common in enterprise and hosting provider scenarios where a single compromised low-privilege account can lead to complete platform compromise. Any authenticated user can exploit this to bypass WordPress's entire permission model.

Casky's 224 matched security skills leverage Claude AI's extended reasoning to map this vulnerability across the MITRE ATT&CK framework, particularly within TA0004 (Privilege Escalation). Practitioners using Casky would identify detection patterns including: suspicious invitation creation requests lacking proper nonce tokens, authenticated users without administrator roles attempting to modify site membership parameters, and authorization bypass attempts in WordPress plugin logs. The platform's skill set would surface indicators such as unusual admin role assignments following autocomplete plugin interactions, anomalous capability checks being bypassed, and privilege escalation chains originating from subscriber-level accounts. Security teams would see these attack patterns flagged in their findings as CWE-269 (Improper Access Control) violations, enabling them to hunt for exploitation attempts, validate patching on multisite installations, and implement access controls that enforce nonce verification and proper capability checks across user-facing plugin functions.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-87759.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-87759

Casky has 224 skills that investigate the attack patterns behind CVE-2026-87759. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn