CVE-2026-87828: Seraphinite Accelerator WordPress DoS Flaw

CVE-2026-87828 Overview

CVE-2026-87828 affects the Seraphinite Accelerator WordPress plugin in versions before 2.29.24. The plugin exposes a state-update AJAX action without performing a capability check. Any authenticated user, including a low-privilege subscriber, can invoke the action and write a malformed value into plugin state. That malformed value triggers an uncaught error on every subsequent admin page load. The result is a persistent denial of service that locks all administrators out of the WordPress admin area. The vulnerability is tracked under [CWE-400] (Uncontrolled Resource Consumption) and requires authentication with user interaction to trigger.

Critical Impact
A subscriber-level account can render the entire WordPress admin area inaccessible to every administrator on the site.

Affected Products

Seraphinite Accelerator WordPress plugin versions prior to 2.29.24
WordPress installations with the vulnerable plugin activated
Any WordPress site permitting subscriber-level registration

Discovery Timeline

2026-09-16 - CVE-2026-87828 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87828

Vulnerability Analysis

The Seraphinite Accelerator plugin registers an AJAX action that updates internal plugin state. The handler validates the WordPress nonce for authentication context but does not verify that the calling user holds the required capability, such as manage_options. Because WordPress AJAX endpoints registered with wp_ajax_ are accessible to any authenticated user, subscribers can reach the handler. The handler accepts input and persists it into the plugin's stored state without validating the value structure. On subsequent admin page loads, plugin bootstrap code reads the stored value and raises an uncaught PHP error. The error halts admin page rendering, blocking access to /wp-admin/ for all users, including administrators. Recovery requires direct database or filesystem intervention to reset the corrupted plugin state.

Root Cause

The root cause is a missing capability check on a privileged AJAX action combined with absent input validation. The handler trusts authenticated requests without verifying user role. Storing attacker-controlled data without schema validation produces a stored condition that consistently triggers an error path.

Attack Vector

An attacker with a subscriber account sends a crafted POST request to the WordPress AJAX endpoint targeting the vulnerable action. The request includes a valid nonce obtainable from an authenticated session and a malformed payload for the state parameter. The plugin writes the payload to persistent storage. Every subsequent admin page load fails until the stored value is manually corrected. Full technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-87828

Indicators of Compromise

Sudden inability of administrators to load any page under /wp-admin/ while the frontend remains functional.
PHP fatal or uncaught error entries in web server logs referencing Seraphinite Accelerator files on admin requests.
admin-ajax.php requests originating from subscriber or low-privilege accounts targeting Seraphinite Accelerator actions.

Detection Strategies

Monitor web server access logs for POST requests to /wp-admin/admin-ajax.php where the action parameter maps to Seraphinite Accelerator state-update handlers.
Correlate authenticated session cookies against user roles to flag privileged AJAX calls from non-administrator accounts.
Review PHP error logs for recurring uncaught exceptions triggered on admin page loads after plugin state changes.

Monitoring Recommendations

Alert on new user registrations followed shortly by AJAX calls to plugin administrative endpoints.
Track failed admin page loads across multiple administrator accounts as a signal of stored denial-of-service conditions.
Baseline Seraphinite Accelerator option values in wp_options and alert on unexpected structural changes.

How to Mitigate CVE-2026-87828

Immediate Actions Required

Update the Seraphinite Accelerator plugin to version 2.29.24 or later on all WordPress installations.
Audit existing user accounts and remove or restrict subscriber accounts that are not required.
If admin lockout has already occurred, restore plugin state directly through database access by resetting the affected plugin option in wp_options.

Patch Information

The vendor released a fixed version in Seraphinite Accelerator 2.29.24. The patch adds a capability check to the affected AJAX action and validates the submitted value before persisting it. Site operators should upgrade through the WordPress plugin dashboard or via WP-CLI using wp plugin update seraphinite-accelerator.

Workarounds

Disable open user registration in WordPress general settings to reduce the pool of accounts able to reach authenticated AJAX endpoints.
Deactivate the Seraphinite Accelerator plugin until the update is applied if immediate patching is not possible.
Apply a web application firewall rule to block requests to admin-ajax.php where the action targets Seraphinite Accelerator handlers from non-administrator sessions.

bash

# Update the plugin via WP-CLI
wp plugin update seraphinite-accelerator --version=2.29.24

# Verify the installed version
wp plugin get seraphinite-accelerator --field=version

# Disable open registration as a hardening measure
wp option update users_can_register 0