Executive brief
The Add User Autocomplete WordPress plugin fails to validate user permissions when creating site membership invitations on multisite installations. An authenticated subscriber can exploit this to grant themselves administrator privileges, gaining full control over the WordPress site and its data.
Technical details
This is a privilege escalation vulnerability caused by missing capability and nonce checks in the plugin's site-membership invitation creation function. The vulnerable component accepts caller-supplied role parameters without authorization validation. Any authenticated user, including those with minimal permissions like subscribers, can invoke the vulnerable function to create a pending membership invitation with an arbitrary role (e.g., administrator). The attack requires authentication but no special setup or user interaction. An attacker can escalate from subscriber to administrator on multisite WordPress installations. The vulnerability is fixed in version 1.2.
Affected products
- Add User Autocomplete Add User Autocomplete before 1.2
Timeline
- 2026-09-12: disclosed: CVE published
- 2026-09-10: patched: Vulnerability publicly disclosed; patch available in version 1.2