Executive brief
The WP Component plugin for WordPress through version 2.2.4 fails to validate user permissions on a critical action, allowing unauthenticated attackers to modify site settings. An attacker can enable new user registration with administrator privileges, leading to complete site takeover on single-site WordPress installations.
Technical details
The plugin implements a WordPress action handler that accepts both option name and option value directly from user requests without capability or nonce verification. This allows unauthenticated attackers to arbitrarily overwrite WordPress site options via an HTTP request. The vulnerability is a broken access control issue (CWE-269) combined with improper input validation. On single-site WordPress installations, an attacker can exploit this to enable user registration with a default administrator role, achieving full administrative control. The plugin through version 2.2.4 is affected; patched versions have not been publicly confirmed.
Affected products
- WordPress WP Component through 2.2.4
Timeline
- 2026-09-10: disclosed
- 2026-09-12: advisory: CVE-2026-85681 published