CVE-2026-87759

The Add User Autocomplete plugin for WordPress, in versions before 1.2, creates pending site-membership invitations without performing any capability check or CSRF nonce verification, and it honors a caller-supplied role for that invitation. As a result, any authenticated user — even one holding only the low-privileged Subscriber role — can send a crafted request to the invitation action, granting an account of their choosing (typically their own) the administrator role. Successful exploitation yields full administrative control of the affected site on a WordPress multisite network, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8, CWE-269 improper privilege management). Only multisite installations running the plugin below version 1.2 are exposed, and the attack is easiest where open registration lets attackers obtain a Subscriber account. No public proof-of-concept exists, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.

What to do: Upgrade to Add User Autocomplete 1.2 or later, which adds the missing capability and nonce checks. If updating is not immediately possible, deactivate the plugin on multisite networks, and audit pending site-membership invitations and user role lists for unexplained administrator accounts. Restricting open registration or minimizing low-privileged Subscriber accounts shrinks the pool of attackers who can trigger the flaw.