CVE-2026-85681: WP Component WordPress Auth Bypass Flaw

CVE-2026-85681 Overview

The WP Component WordPress plugin through version 2.2.4 exposes an AJAX action to unauthenticated users without capability or nonce checks. Attackers supply both the option name and the option value in the request, allowing arbitrary overwrite of any WordPress option stored in the wp_options table. On a single-site installation, an attacker enables user registration and sets the default role to administrator, then registers a privileged account. This results in full site takeover without authentication or user interaction. The flaw is tracked under CWE-269: Improper Privilege Management.

Critical Impact

Unauthenticated remote attackers can overwrite arbitrary WordPress options and gain administrator access on single-site installations running WP Component through 2.2.4.

Affected Products

• WP Component WordPress plugin, all versions through 2.2.4
• WordPress single-site installations with the plugin active
• Any site exposing wp-admin/admin-ajax.php to the internet with the vulnerable plugin enabled

Discovery Timeline

• 2026-09-12 - CVE-2026-85681 published to the National Vulnerability Database
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-85681

Vulnerability Analysis

The WP Component plugin registers an AJAX action reachable through wp-admin/admin-ajax.php for unauthenticated visitors. The handler reads the target option name and new value directly from user-supplied request parameters. It then passes those inputs to WordPress's update_option() function without validating the caller or the option scope.

Because WordPress stores critical site configuration in the options table, arbitrary writes to that table translate directly into control of authentication behavior, active theme, site URL, and many other trust-sensitive settings. Attackers can chain two option writes to complete an account takeover: set users_can_register to 1 and set default_role to administrator. A subsequent registration through the standard wp-login.php?action=register endpoint yields an administrator account.

Additional technical context is available in the WPScan Vulnerability Analysis.

Root Cause

The handler omits two required WordPress security controls. It does not verify a nonce using check_ajax_referer(), and it does not gate the action on a capability such as manage_options through current_user_can(). Registering the callback on the wp_ajax_nopriv_ hook also exposes the handler to unauthenticated requests. The combination of missing authorization and unrestricted option targeting maps to CWE-269: Improper Privilege Management.

Attack Vector

An attacker sends a single HTTP POST request to admin-ajax.php invoking the vulnerable action with option_name and option_value parameters. No credentials, no cookies, and no user interaction are required. The attack is fully network-reachable against any exposed WordPress site running the vulnerable plugin.

// Conceptual request flow (no verified PoC published)
POST /wp-admin/admin-ajax.php
action=<vulnerable_action>&option_name=users_can_register&option_value=1
POST /wp-admin/admin-ajax.php
action=<vulnerable_action>&option_name=default_role&option_value=administrator
GET  /wp-login.php?action=register

Detection Methods for CVE-2026-85681

Indicators of Compromise

• Unauthenticated POST requests to /wp-admin/admin-ajax.php containing option_name and option_value parameters from external IP addresses.
• Unexpected changes to the users_can_register or default_role values in the WordPress wp_options table.
• New administrator accounts created shortly after suspicious admin-ajax.php traffic.
• Modifications to siteurl, home, template, or active_plugins options without a corresponding administrator session.

Detection Strategies

• Review web server access logs for POST requests to admin-ajax.php referencing the WP Component plugin's action name with attacker-controlled option parameters.
• Compare current wp_options values against a known-good baseline and alert on drift in security-sensitive keys.
• Monitor WordPress user tables for new accounts with the administrator role that were created through the public registration flow.

Monitoring Recommendations

• Enable WordPress audit logging for option changes, user creation, and plugin activation events.
• Forward web server, PHP error, and WordPress audit logs to a centralized analytics platform for correlation across the request chain.
• Alert on the sequence of an admin-ajax.php request followed by a self-service registration event from the same source address.

How to Mitigate CVE-2026-85681

Immediate Actions Required

• Deactivate and remove the WP Component plugin on any WordPress installation running version 2.2.4 or earlier until a fixed release is confirmed.
• Audit the wp_users and wp_usermeta tables for unauthorized administrator accounts and remove them.
• Reset credentials for all administrator accounts and rotate WordPress salts in wp-config.php.
• Review recent option changes and restore trusted values for users_can_register, default_role, siteurl, home, template, and active_plugins.

Patch Information

No vendor-confirmed patched release is listed in the enriched CVE data at the time of publication. Monitor the WPScan Vulnerability Analysis entry and the plugin's WordPress.org page for a fixed version above 2.2.4. Apply the update as soon as it is published.

Workarounds

• Block or rate-limit unauthenticated POST requests to /wp-admin/admin-ajax.php that carry the vulnerable plugin's action parameter using a web application firewall rule.
• Force DISALLOW_FILE_MODS and set users_can_register to 0 in configuration to reduce the blast radius if the option is overwritten.
• Restrict access to wp-admin by source IP where operationally feasible.

# Example WordPress hardening in wp-config.php
define( 'DISALLOW_FILE_MODS', true );
define( 'DISALLOW_FILE_EDIT', true );
# Verify registration is disabled at the database level
wp option update users_can_register 0
wp option update default_role subscriber