PatchSiren cyber security CVE debrief
CVE-2026-4297 newscred CVE debrief
The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This vulnerability, CVE-2026-4297, is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() but does not perform any authorization check such as current_user_can('manage_options'). This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary WordPress options via XML-RPC requests. This can be leveraged to change the default_role option to 'administrator' and then register a new administrator account, achieving full privilege escalation and site takeover. The vulnerability has a CVSS score of 8.8 and is considered HIGH severity.
- Vendor
- newscred
- Product
- Welcome Software Publishing
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-24
- Original CVE updated
- 2026-06-25
- Advisory published
- 2026-06-24
- Advisory updated
- 2026-06-25
Who should care
WordPress site administrators and owners using the Welcome Software Publishing plugin should be aware of this vulnerability and take immediate action to protect their sites. This vulnerability can be exploited by authenticated attackers with Subscriber-level access and above, making it a significant risk for sites with multiple users or those that allow user registration.
Technical summary
The vulnerability in the Welcome Software Publishing plugin for WordPress is caused by a missing capability check in the nc_setOption() function. This function is exposed via the nc.setOption XML-RPC method and allows authenticated attackers to update arbitrary WordPress options. The function uses $wp_xmlrpc_server->login() to authenticate users but does not perform any authorization checks, such as current_user_can('manage_options'). This allows attackers with Subscriber-level access and above to exploit the vulnerability. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Defensive priority
High priority should be given to updating the Welcome Software Publishing plugin to a version that fixes this vulnerability. Site administrators should also review their user accounts and ensure that only authorized users have elevated privileges.
Recommended defensive actions
- Update the Welcome Software Publishing plugin to the latest version.
- Review user accounts and ensure that only authorized users have elevated privileges.
- Monitor site activity for suspicious XML-RPC requests.
- Consider limiting XML-RPC access to only trusted IP addresses.
- Regularly review and update WordPress and its plugins.
Evidence notes
The CVE record for CVE-2026-4297 was published on June 24, 2026, and modified on June 25, 2026. The vulnerability was reported by [email protected] and has a CVSS score of 8.8. The NVD detail page and CVE record provide further information about the vulnerability.
Official resources
This article is AI-assisted and based on the supplied source corpus.