high advisory November 12, 2026

CourseCure Courses: Privilege Escalation (CVE-2026-15309)

The CourseCure Courses WordPress plugin contains a privilege escalation vulnerability in the ajax_save_settings function, allowing authenticated subscribers to elevate privileges to administrator by modifying arbitrary WordPress options.

Triage facts

Revision 1

Applicability: Courses (<= 1.5.1)
Evidence: Unknown
Severity: High
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Nov 12, 14:15 UTC
Detection: 1 rule
Vulnerabilities: 1 CVE
Source quality: A1Very likely

The CourseCure Courses plugin for WordPress, in versions up to and including 1.5.1, is vulnerable to privilege escalation. The vulnerability exists within the ajax_save_settings function, which lacks adequate capability checks. This allows authenticated users with subscriber-level access to manipulate arbitrary WordPress options via POST requests. By modifying key options such as default_role and users_can_register, an attacker can ensure new account registrations are granted administrative privileges.

Impact

Successful exploitation allows an authenticated subscriber-level attacker to gain full administrative control over the affected WordPress instance. This risk is classified with a CVSS v3.1 base score of 8.8.

Recommendation

Identify all instances of the CourseCure Courses plugin within the environment. If the current version is 1.5.1 or lower, disable or remove the plugin until a security patch is provided by the vendor. Hunt for unusual HTTP POST requests directed toward the plugin's settings saving endpoint.

Immediate actions

Inventory WordPress installations using CourseCure Courses plugin

SOC 24h

Threat Hunt

Identify suspicious user accounts created after the plugin installation that hold administrator privileges.

T1068 high high confidence hunt now

Data: WordPress user registration logs, Database audit logs showing changes to wp_options

Detection coverage 1

Detect CVE-2026-15309 Exploitation - Unauthorized Settings Modification

high

Detects potential exploitation of CVE-2026-15309 by monitoring HTTP POST requests to the ajax_save_settings function, which is the vector for arbitrary option modification.

sigma tactics: privilege_escalation techniques: T1068 sources: webserver

Detection queries are available on the platform. Get full rules →