CVE-2026-85681
Received Received - Intake

Unauthenticated Option Overwrite in WP Component WordPress Plugin

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: WPScan

Description
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-85681
EUVD
EUVD-2026-76796

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wp_component wp_component to 2.2.4 (inc)
wp_component wordpress_plugin 2.2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WP Component WordPress plugin up to version 2.2.4. It lacks capability or nonce checks on an action, allowing unauthenticated users to modify any site option by sending a request with the option name and value. On single-site setups, this can enable user registration with an administrator role, leading to full site takeover.

Detection Guidance

To detect this vulnerability, check if the WP Component plugin version 2.2.4 or earlier is installed. Review server logs for suspicious POST requests targeting the vulnerable action, particularly those attempting to modify site options like registration settings or user roles.

Impact Analysis

An attacker could exploit this to overwrite critical site options, including enabling user registration with admin privileges. This would allow them to gain full control of the WordPress site, including adding malicious users, modifying content, or installing backdoors.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health data security) requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to compromised user data or privacy violations.

Mitigation Strategies

Immediately update the WP Component plugin to the latest version beyond 2.2.4. If an update is unavailable, disable the plugin entirely. Review site options for unauthorized changes, especially registration settings and administrator roles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart