CVE-2026-8157

—

CVSS 3.1

8.8 high

EPSS

<1%p35

Published

Jun 22, 2026 (Jun 22, 2026)

Modified

Jun 22, 2026

Description

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.

Ecosystems: WordPress
Weakness: CWE-269
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.