Cpe:2.3:a:coursecure:courses:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3acoursecurecourseswordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 14:15:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCourseCure Courses: Privilege Escalation (CVE-2026-15309)https://feed.craftedsignal.io/briefs/2026-11-coursecure-privilege-escalation-cve-2026-15309/Thu, 12 Nov 2026 14:15:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-coursecure-privilege-escalation-cve-2026-15309/The CourseCure Courses WordPress plugin contains a privilege escalation vulnerability in the ajax_save_settings function, allowing authenticated subscribers to elevate privileges to administrator by modifying arbitrary WordPress options.The CourseCure Courses plugin for WordPress, in versions up to and including 1.5.1, is vulnerable to privilege escalation. The vulnerability exists within the ajax_save_settings function, which lacks adequate capability checks. This allows authenticated users with subscriber-level access to manipulate arbitrary WordPress options via POST requests. By modifying key options such as default_role and users_can_register, an attacker can ensure new account registrations are granted administrative privileges.

Impact

Successful exploitation allows an authenticated subscriber-level attacker to gain full administrative control over the affected WordPress instance. This risk is classified with a CVSS v3.1 base score of 8.8.

Recommendation

Identify all instances of the CourseCure Courses plugin within the environment. If the current version is 1.5.1 or lower, disable or remove the plugin until a security patch is provided by the vendor. Hunt for unusual HTTP POST requests directed toward the plugin's settings saving endpoint.

]]>highadvisory