Executive brief
The Welcome Software Publishing plugin for WordPress contains a security flaw that allows users with basic account access to change critical website settings. By exploiting this vulnerability, an attacker can elevate their own permissions to become a site administrator. This results in a complete takeover of the website, allowing the attacker to modify content, access sensitive data, or lock out legitimate owners.
Technical details
The Welcome Software Publishing plugin for WordPress is vulnerable to an arbitrary options update due to a missing authorization check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. While the function verifies that a user is logged in using $wp_xmlrpc_server->login(), it fails to verify if the user has the 'manage_options' capability. This allows authenticated attackers with Subscriber-level permissions or higher to modify any WordPress option. A common exploit path involves changing the 'default_role' to 'administrator' to facilitate full site takeover via new user registration. All versions up to and including 0.0.31 are affected.
Affected products
- newscred Welcome Software Publishing <= 0.0.31
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/newscred-publishing/tags/0.0.31/newscred.php
- https://plugins.trac.wordpress.org/browser/newscred-publishing/tags/0.0.31/newscred.php
- https://plugins.trac.wordpress.org/browser/newscred-publishing/tags/0.0.31/newscred.php
- https://plugins.trac.wordpress.org/browser/newscred-publishing/tags/0.0.31/newscred.php
- https://plugins.trac.wordpress.org/browser/newscred-publishing/trunk/newscred.php
- https://plugins.trac.wordpress.org/browser/newscred-publishing/trunk/newscred.php
- https://plugins.trac.wordpress.org/browser/newscred-publishing/trunk/newscred.php