CVE-2026-8157

HighCVSS 8.8/10Last modified Jun 22, 2026

Description

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Unknown	Vitepos	< 3.4.2

References

https://wpscan.com/vulnerability/6680cc6a-9758-4040-bb39-7b9545041dc3/

Timeline

Published: Jun 22, 2026
Last modified: Jun 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-815714.8The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shor CVE-2026-815727.8In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictabl CVE-2026-815738.6If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin rest CVE-2026-815748.2In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to in CVE-2026-815757.5If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length CVE-2026-815767.7If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically CVE-2026-815789.8An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, u CVE-2026-815798.8In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows CVE-2026-81585.3The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exc CVE-2026-815818.8Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the p CVE-2026-815835.4The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite in CVE-2026-815848.1An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) be