CVE-2026-57661

Summary dbcve.org

Broken Access Control vulnerability in the WPComplete WordPress plugin allows authenticated users with Subscriber role to access functionality or data that should be restricted to higher-privileged roles. This indicates insufficient capability checks or authorization logic in the plugin's code, potentially letting low-privilege users perform actions intended for administrators or other privileged users.

Mitigation

Update WPComplete to a version newer than 2.9.5.5 which contains proper access control enforcement, or implement plugin-level capability checks on all sensitive functions until the vendor patch is applied.