CVE-2026-87759: WordPress Add User Autocomplete Escalation

CVE-2026-87759 Overview

The Add User Autocomplete WordPress plugin before version 1.2 contains a privilege escalation flaw on WordPress multisite installations. The plugin creates pending site-membership invitations without validating capability or nonce checks. The invitation payload accepts a caller-supplied role value. Any authenticated user, including a low-privileged subscriber, can craft a request that grants themselves the administrator role. This weakness maps to [CWE-269] Improper Privilege Management.

Critical Impact
An authenticated subscriber on a WordPress multisite network can elevate to administrator, gaining full control over site content, plugins, themes, and user accounts.

Affected Products

Add User Autocomplete WordPress plugin versions prior to 1.2
WordPress multisite installations running the vulnerable plugin
Any WordPress network permitting subscriber-level registration on affected sites

Discovery Timeline

2026-09-12 - CVE-2026-87759 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-87759

Vulnerability Analysis

The Add User Autocomplete plugin exposes a request handler that creates pending site-membership invitations. The handler omits two standard WordPress security controls: a current_user_can() capability check and a check_ajax_referer() or wp_verify_nonce() nonce validation. The role assigned to the invitation is read directly from user-controlled input rather than being restricted to a safe default or validated against an allow-list. On a multisite installation, accepting the invitation binds the caller-supplied role to the requesting user's account for the target site. A subscriber account, which normally has read-only permissions, becomes an administrator with rights to install plugins, edit code, and manage users.

Root Cause

The root cause is missing authorization enforcement in the invitation creation flow. The plugin trusts the authenticated session as sufficient proof of intent and authority. It does not verify that the requesting user holds a role permitted to invite members or assign elevated roles. The absence of a nonce also allows the request to be triggered by cross-site request forgery against a logged-in user.

Attack Vector

An attacker registers or uses an existing low-privileged account on the multisite network. The attacker sends an HTTP request to the plugin's invitation endpoint with the role parameter set to administrator and the invitee email set to their own address. The plugin creates the invitation, and once accepted, the attacker's account is granted administrator privileges on the target site. Because the flaw requires only low privileges and no user interaction, exploitation can be scripted at scale across affected networks. Refer to the WPScan Vulnerability Report for the disclosed technical details.

Detection Methods for CVE-2026-87759

Indicators of Compromise

Unexpected wp_usermeta entries assigning administrator capabilities to accounts that were recently subscribers
Pending or accepted site-membership invitations issued to users who never received an explicit invite from a site admin
HTTP POST requests to plugin endpoints containing a role=administrator parameter from non-admin session cookies
New administrator logins from IP addresses previously associated only with subscriber activity

Detection Strategies

Audit the wp_users and wp_usermeta tables across all sites in the network for role changes that lack a corresponding admin action in the audit log
Correlate web server access logs for requests to Add User Autocomplete handlers where the authenticated user does not hold promote_users capability
Enable WordPress activity logging plugins to capture role assignment events and alert on subscriber-to-administrator transitions

Monitoring Recommendations

Alert on any role escalation event that occurs outside a documented change window
Monitor plugin AJAX endpoints for requests missing the expected _wpnonce parameter
Track invitation acceptance events and flag those where the invitee and inviter identities are the same account

How to Mitigate CVE-2026-87759

Immediate Actions Required

Update the Add User Autocomplete plugin to version 1.2 or later on every site in the multisite network
Review all administrator accounts created since the plugin was installed and remove unauthorized privilege grants
Rotate credentials and session tokens for any account confirmed to have been elevated through the flaw
Disable open subscriber registration on multisite installations until the patch is applied

Patch Information

The vendor addressed the issue in Add User Autocomplete version 1.2 by adding capability and nonce checks to the invitation creation handler and by validating the role parameter against an allow-list. See the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate the Add User Autocomplete plugin network-wide until version 1.2 can be deployed
Restrict access to /wp-admin/admin-ajax.php for non-administrator roles using a web application firewall rule
Temporarily require multi-factor authentication for any account granted the administrator role to slow exploitation impact

bash

# Configuration example: deactivate the plugin network-wide via WP-CLI
wp plugin deactivate add-user-autocomplete --network
wp plugin update add-user-autocomplete --version=1.2