{"id":"CVE-2026-105894","aliases":["EUVD-2026-114234","GHSA-rq7c-4vhw-wv57"],"status":"published","title":"Ak Framework \u003c= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update","description":"The Ak Framework plugin for WordPress, included in the Newsy - Viral News \u0026 Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00318,"percentile":0.25033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-10-30T17:15:32Z","modified":"2026-10-30T19:18:00Z","products":[{"vendor":"akbilisim","product":"ak framework"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f99ab9-eb22-4766-81f2-647af1229815?source=cve"},{"url":"https://docs.akbilisim.com/newsy/changelog/#v299"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105894"},{"url":"https://github.com/advisories/GHSA-rq7c-4vhw-wv57"}],"sources":{"cve":[{"id":"CVE-2026-105894","title":"Ak Framework \u003c= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update","description":"The Ak Framework plugin for WordPress, included in the Newsy - Viral News \u0026 Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.","status":"published","published":"2026-10-30T17:15:32.867Z","modified":"2026-10-30T18:08:56.279Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-114234","description":"The Ak Framework plugin for WordPress, included in the Newsy - Viral News \u0026 Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.","status":"published","published":"2026-10-30T17:15:32Z","modified":"2026-10-30T18:08:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:03.071815Z"}],"ghsa":[{"id":"GHSA-rq7c-4vhw-wv57","title":"The Ak Framework plugin for WordPress, included in the Newsy - Viral News \u0026 Magazine WordPress...","description":"The Ak Framework plugin for WordPress, included in the Newsy - Viral News \u0026 Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.","status":"published","published":"2026-10-30T18:32:43Z","modified":"2026-10-30T18:32:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:14:52.01816Z"}],"nvd":[{"id":"CVE-2026-105894","description":"The Ak Framework plugin for WordPress, included in the Newsy - Viral News \u0026 Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.","status":"published","published":"2026-10-30T18:17:16.483Z","modified":"2026-10-30T19:18:00.977Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:13:05.268617Z"}]}}