{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/courses--1.5.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:coursecure:courses:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-15309"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Courses (\u003c= 1.5.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["CourseCure"],"content_html":"\u003cp\u003eThe CourseCure Courses plugin for WordPress, in versions up to and including 1.5.1, is vulnerable to privilege escalation. The vulnerability exists within the ajax_save_settings function, which lacks adequate capability checks. This allows authenticated users with subscriber-level access to manipulate arbitrary WordPress options via POST requests. By modifying key options such as default_role and users_can_register, an attacker can ensure new account registrations are granted administrative privileges.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated subscriber-level attacker to gain full administrative control over the affected WordPress instance. This risk is classified with a CVSS v3.1 base score of 8.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eIdentify all instances of the CourseCure Courses plugin within the environment. If the current version is 1.5.1 or lower, disable or remove the plugin until a security patch is provided by the vendor. Hunt for unusual HTTP POST requests directed toward the plugin's settings saving endpoint.\u003c/p\u003e\n","date_modified":"2026-11-12T14:15:22Z","date_published":"2026-11-12T14:15:22Z","id":"https://feed.craftedsignal.io/briefs/2026-11-coursecure-privilege-escalation-cve-2026-15309/","summary":"The CourseCure Courses WordPress plugin contains a privilege escalation vulnerability in the ajax_save_settings function, allowing authenticated subscribers to elevate privileges to administrator by modifying arbitrary WordPress options.","title":"CourseCure Courses: Privilege Escalation (CVE-2026-15309)","url":"https://feed.craftedsignal.io/briefs/2026-11-coursecure-privilege-escalation-cve-2026-15309/"}],"language":"en","title":"CraftedSignal Threat Feed - Courses (\u003c= 1.5.1)","version":"https://jsonfeed.org/version/1.1"}