CVE-2026-15309

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajaxsavesettings function, which accepts arbitrary POST parameters and calls updateoption with attacker-controlled keys and...

CVE-2026-15309

The CourseCure Courses plugin for WordPress (versions up to and including 1.5.1 ) is vulnerable to Privilege Escalation via the ajax_save_settings() function. The root cause is a missing capability check that allows authenticated users with subscriber-level access or higher to submit arbitrary PO...

CVE-2026-15309 CourseCure Courses <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajaxsavesettings function, which accepts arbitrary POST parameters and calls updateoption with attacker-controlled keys and...

EUVD-2026-124347

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajaxsavesettings function, which accepts arbitrary POST parameters and calls updateoption with attacker-controlled keys and...

WordPress CourseCure Courses plugin <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint vulnerability

Authenticated Subscriber+ Privilege Escalation to 'ajaxsavesettings' Endpoint vulnerability discovered by Austin Ginder in WordPress Plugin CourseCure Courses versions = 1.5.1...