{"id":"CVE-2026-87784","published":"2026-11-06T06:16:44.363","lastModified":"2026-11-06T06:16:44.363","description":"The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/16788a03-d95b-4675-868a-dd56cc3365b6/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}