CVE-2026-85681

The WP Component WordPress plugin through version 2.2.4 exposes an action to unauthenticated users that has no capability or nonce checks, and it takes both the option name and the option value directly from the request. This allows any unauthenticated attacker to overwrite arbitrary WordPress site options by sending a single crafted HTTP request. On single-site installations this leads to a full takeover, since the attacker can enable user registration with a default role of administrator and then create an administrator account. Any site running the plugin at or including version 2.2.4 is affected, and the advisory does not specify a fixed version. There is no known public proof of concept, no evidence of in-the-wild exploitation, and the CVE is not on CISA's KEV list.

What to do: Upgrade WP Component to a version later than 2.2.4 as soon as a patched release is available, or remove the plugin entirely if no fix is forthcoming. Inspect the site's options for tampering — particularly 'users_can_register' enabled and 'default_role' set to administrator — and audit the users list for unauthorized administrator accounts. Review access logs for unauthenticated POST requests hitting the plugin's option-writing action endpoint.