WP Component lets unauthenticated callers overwrite site options
WP Component through 2.2.4 exposes an unauthenticated action with no capability or nonce check and accepts both the WordPress option name and value from the request. An attacker can overwrite arbitrary options; on a single-site installation, enabling registration and setting the default role to administrator leads to full takeover. The authoritative export does not name the action or parameters.
- Component
- WP Component
- Plugin slug
wp-component- Affected
- <= 2.2.4
- Safe version
- See mitigation notes
- Published
- Sep 12, 2026
This CVE was published Sep 12, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
No fixed release is confirmed in the authoritative export. Deactivate the plugin until a vendor-confirmed release is available. The application-level fix must remove unauthenticated access, require an appropriate capability and nonce, and allowlist the specific option keys and values the action may change.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H