Description

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-12T06:16:27.547Z",
  "pubdate": "2026-09-12T06:16:27.547Z",
  "executiveSummary": "The Add User Autocomplete WordPress plugin before version 1.2 is susceptible to an unauthorized privilege escalation vulnerability. The flaw exists due to missing capability and nonce validation in the plugin's invitation creation mechanism. By exploiting this vulnerability, any authenticated user—including those with minimal privileges such as subscribers—can manipulate invitation parameters to assign themselves the administrator role on a WordPress multisite installation. This bypasses the intended administrative access controls, leading to a complete compromise of the site's security and data integrity. The attack requires authenticated access to the network, but no specific administrative permissions, making it a critical security risk for multisite environments that allow user registration.",
  "technicalDetails": "The vulnerability resides in the backend logic of the Add User Autocomplete plugin, which facilitates user management and site-membership invitations. The root cause is the absence of security nonces and capability checks (e.g., current_user_can()) within the invitation processing function. In a WordPress multisite configuration, the plugin fails to verify if the requester has the requisite authority to manage user roles or issue membership invitations.\nThe attack flow begins when an authenticated user (with subscriber-level access) submits a specially crafted request to the plugin's invitation endpoint. Since the plugin does not enforce a CSRF protection nonce, the attacker can successfully initiate the request. The payload of this request includes a 'role' parameter, which the plugin blindly trusts and processes during the creation of a pending site-membership invitation. Because the underlying logic assumes that all requests to this function are initiated by an authorized administrator, it fails to sanitize or validate the user-supplied role value.\nBy setting the 'role' parameter to 'administrator' within the invitation request, the attacker forces the system to generate an invitation record that grants administrative privileges upon acceptance. In the context of a multisite network, this effectively elevates the attacker's context to a super-user or site-administrator status. Once the invitation is processed by the system, the attacker is granted the requested high-privilege role, granting them full control over site settings, plugins, themes, and user management.\nThe impact is significant, as the exploitation is trivial and does not require complex binary manipulation or bypassing WAF rules that focus on common SQLi or XSS patterns. The lack of proper authorization checks means the plugin functions as an unauthenticated privilege escalation primitive once the attacker possesses a valid session cookie. Post-exploitation, an attacker can execute arbitrary administrative actions, install malicious themes or plugins to gain persistent remote code execution (RCE), and exfiltrate sensitive site data, fundamentally undermining the security architecture of the multisite installation."
}