CVE-2026-115255

{
  "etk_id": "ETK-2026-2840",
  "cve_id": "CVE-2026-115255",
  "display_id": "CVE-2026-115255",
  "ghsa_id": "GHSA-j835-2vx3-j669",
  "euvd_id": "EUVD-2026-111731",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated account deletion in WP Roster",
  "summary": "WP Roster versions before 2.35 are affected by missing authorization and nonce validation in an AJAX action. An unauthenticated attacker can delete WordPress user accounts associated with roster members. Exploitation requires the vulnerable plugin to be installed and its affected AJAX action to be reachable.",
  "mitigation": "Upgrade WP Roster to version 2.35 or later. Restrict public access to the affected site until the update is applied.",
  "vendor": null,
  "product": "WP Roster",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.35"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.35"
      ],
      "package_name": "WP Roster",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.37847365,
  "t0_at": "2026-10-28T06:00:27.222000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-28T06:00:27.222000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T06:00:27.222000+00:00",
      "url": "https://github.com/advisories/GHSA-j835-2vx3-j669"
    }
  }
}