Unauthenticated Role Escalation in WordPress Media Filter Plugin

The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Cool Media Filter WordPress plugin through version 1.0.1 contains a critical privilege escalation vulnerability that allows any authenticated user—including those with minimal permissions like subscribers—to elevate their own role to administrator without proper authorization checks. This occurs because the plugin fails to implement capability verification and nonce validation when processing role update requests. WordPress site owners using this plugin are exposed to rapid account takeover, where attackers with even basic access can seize full administrative control, compromise sensitive data, and inject malicious code. With an 8.8 CVSS score and the vulnerability affecting the core privilege management system, this represents a severe risk to any WordPress installation running the affected plugin versions.

Casky's 224 matched security skills leverage Claude AI with extended reasoning to identify the attack patterns associated with TA0004 (Privilege Escalation) techniques underlying this vulnerability. Practitioners using Casky would detect suspicious role modification requests lacking proper authorization context—specifically, API calls to update user capabilities without corresponding nonce tokens or capability checks that should only be accessible to high-privileged users. The platform's skills would flag authentication bypass patterns where low-privilege accounts trigger administrator-level permission changes, correlating behavioral anomalies with CWE-269 (Improper Access Control) indicators. Security teams would see findings highlighting unauthenticated administrative function calls in plugin logs, allowing them to identify exploitation attempts in real-time and trace which subscriber accounts attempted unauthorized privilege escalation before compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-87784.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-87784

Casky has 224 skills that investigate the attack patterns behind CVE-2026-87784. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn