MEDIUM
CVE-2026-87828
CVSS
5.7
Description
The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).
Weakness (CWE)
CWE-400
Uncontrolled Resource Consumption
EPSS Score
0.24%
Probability of exploitation in next 30 days
15.7th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.