The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Add User Autocomplete Plugin | — | Update add-user-autocomplete plugin to version 1.2, or a newer patched version | Oct 30, 2026 | Sep 14, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub