CVE-2026-8157

CVE-2026-8157 concerns the Vitepos WordPress plugin (pre-3.4.2). The issue arises because the REST API endpoint used to create new users does not properly restrict which roles can be assigned, enabling an authenticated attacker with a specific plugin-provided role to escalate privileges to admini...