WordPress Plugin Vulnerabilities
Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update
Description
The plugin does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).
Proof of Concept
Affects Plugins
References
CVE
Miscellaneous
Original Researcher
Ángel PS (drtz)
Submitter
Ángel PS (drtz)
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)