Is CVE-2026-15309 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15309 being exploited in the wild.

How severe is CVE-2026-15309?

High severity, with a CVSS score of 8.8, published 12 November 2026.

Which products and versions are affected?

WishList Member CourseCure Courses up to and including 1.5.1.

Is there a fix for CVE-2026-15309?

Yes: fixed in 1.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15309 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-15309?

Check whether you run WishList Member CourseCure Courses at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15309: CourseCure Courses privilege escalation via missing capability check

CVE-2026-15309 · Severity: high · CVSS 8.8 · Published 2026-11-12

The CourseCure Courses plugin for WordPress allows authenticated subscribers to become administrators by exploiting a missing authorization check in the settings update function. An attacker with a basic subscriber account can modify WordPress options to auto-grant administrator privileges to newly registered accounts, gaining full control of the website.

Vendors: WishList Member.

Quick answers

Is CVE-2026-15309 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15309 being exploited in the wild.
How severe is CVE-2026-15309?: High severity, with a CVSS score of 8.8, published 12 November 2026.
Which products and versions are affected?: WishList Member CourseCure Courses up to and including 1.5.1.
Is there a fix for CVE-2026-15309?: Yes: fixed in 1.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15309 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-15309?: Check whether you run WishList Member CourseCure Courses at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.5.3

Technical details

The ajax_save_settings() function accepts arbitrary POST parameters and passes them directly to update_option() without verifying user capabilities, allowing privilege escalation from subscriber to administrator. An authenticated attacker can set default_role to 'administrator' and enable user registration, then create an account with full admin access. This requires authentication but no additional user interaction.

Affected products

WishList Member CourseCure Courses up to and including 1.5.1

Timeline

2026-11-12: disclosed
2026-09-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.