WordPress Plugin Vulnerabilities

Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update

Description

The plugin does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).

Proof of Concept

Affects Plugins

Fixed in 2.29.24

References

Miscellaneous

Original Researcher
Ángel PS (drtz)
Submitter
Ángel PS (drtz)
Verified
Yes

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other