CVE-2026-115257

{
  "etk_id": "ETK-2026-3479",
  "cve_id": "CVE-2026-115257",
  "display_id": "CVE-2026-115257",
  "ghsa_id": "GHSA-p54f-4qj5-25h3",
  "euvd_id": "EUVD-2026-116729",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authorization for roster updates in WP Roster",
  "summary": "WP Roster versions before 2.36 allow roster data to be changed without authentication. An attacker able to reach an affected WordPress site can alter, erase, or restore roster entries because update requests are not access-controlled.",
  "mitigation": "Update WP Roster to version 2.36 or later. Until updating, restrict public access to affected WordPress sites where feasible.",
  "vendor": null,
  "product": "WP Roster",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2.36"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.36"
      ],
      "package_name": "WP Roster",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.013129633333333333,
  "t0_at": "2026-11-04T06:00:27.201000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-04T09:21:11.804712+00:00",
      "days": 0.13940513555555556,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T06:00:27.201000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-04T06:00:27.201000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T06:00:27.201000+00:00",
      "url": "https://github.com/advisories/GHSA-p54f-4qj5-25h3"
    }
  }
}