CVE-2026-57661: WPComplete Auth Bypass Vulnerability

CVE-2026-57661 Overview

CVE-2026-57661 is a broken access control vulnerability in the WPComplete WordPress plugin affecting versions up to and including 2.9.5.5. The flaw is classified under CWE-862: Missing Authorization and allows authenticated users with the low-privileged Subscriber role to perform actions that should be restricted to higher-privileged accounts. Exploitation requires network access and valid credentials, but no user interaction. The issue was documented in the Patchstack Vulnerability Report.

Critical Impact
Authenticated Subscriber-level users can bypass access controls in WPComplete <= 2.9.5.5, leading to limited integrity and availability impact on affected WordPress sites.

Affected Products

WPComplete WordPress plugin versions <= 2.9.5.5
WordPress sites with the WPComplete plugin installed and active
WordPress environments allowing Subscriber-level account registration

Discovery Timeline

2026-06-26 - CVE-2026-57661 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57661

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the WPComplete plugin. WPComplete provides course completion tracking functionality for WordPress, and the affected code paths do not properly verify the capabilities of the calling user before executing privileged operations.

An authenticated attacker holding the WordPress Subscriber role, the lowest default privilege tier, can invoke plugin actions intended for administrators or editors. The result is limited integrity impact and limited availability impact on the affected site, though confidentiality is not affected. The attack requires low complexity and can be executed over the network.

Root Cause

The root cause is a missing authorization check ([CWE-862]) in one or more of the plugin's request handlers. The code executes state-changing operations without calling WordPress capability checks such as current_user_can() or verifying an appropriate nonce tied to a privileged action. Any user with a valid session, including Subscribers, satisfies the authentication requirement and reaches the vulnerable handler.

Attack Vector

An attacker registers or obtains a Subscriber account on a target WordPress site running WPComplete <= 2.9.5.5. The attacker then issues crafted HTTP requests to plugin endpoints that lack capability enforcement. Because the requests originate from an authenticated session, WordPress accepts them and the plugin performs actions the user should not be permitted to invoke. Refer to the Patchstack Vulnerability Report for further technical details.

No public proof-of-concept code has been verified for this issue. The vulnerability mechanism is described in prose only.

Detection Methods for CVE-2026-57661

Indicators of Compromise

Unexpected changes to WPComplete course or completion state performed by low-privilege user IDs
HTTP POST requests to wp-admin/admin-ajax.php or plugin-specific endpoints originating from Subscriber accounts
Newly registered Subscriber accounts followed shortly by plugin-related administrative actions

Detection Strategies

Inventory WordPress installations and identify sites running WPComplete at version <= 2.9.5.5
Review WordPress audit logs for plugin actions performed by users with the subscriber role
Correlate authentication events with plugin request patterns to identify privilege boundary violations

Monitoring Recommendations

Enable a WordPress audit logging plugin to capture role-based action history
Alert on Subscriber accounts issuing requests to admin-oriented AJAX or REST endpoints
Monitor web server access logs for anomalous request rates to WPComplete endpoints from non-privileged sessions

How to Mitigate CVE-2026-57661

Immediate Actions Required

Update WPComplete to a version later than 2.9.5.5 once a patched release is available from the vendor
Audit existing Subscriber accounts and remove any that are unrecognized or unnecessary
Disable open user registration on WordPress sites that do not require it by unchecking the Anyone can register option under Settings > General

Patch Information

Consult the Patchstack Vulnerability Report for the latest patch status. Apply the fixed version of WPComplete as soon as the vendor publishes it. Until a patch is applied, treat the plugin as vulnerable on any site running <= 2.9.5.5.

Workarounds

Deactivate the WPComplete plugin until a patched version is installed if the functionality is not business-critical
Restrict access to wp-admin/admin-ajax.php and WPComplete endpoints using a web application firewall rule that blocks Subscriber-level sessions
Enforce strong registration controls, including CAPTCHA and email verification, to reduce the number of untrusted Subscriber accounts

bash

# Configuration example: disable open registration via wp-cli
wp option update users_can_register 0

# Deactivate the vulnerable plugin until patched
wp plugin deactivate wpcomplete