HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-4297 — The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary ...

·Source: NIST NVD

Updated:

Executive Summary

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authori

Analysis

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authorization check such as current_user_can('manage_options'). This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary WordPress options via XML-RPC requests. This can be leveraged to change the default_role option to 'administrator' and then register a new administrator account, achieving full privilege escalation and site takeover. CVSS Score: 8.8. Published: 2026-06-24T07:16:27.310.

Indicators of Compromise (1)

CVE (1)
CVE-2026-4297
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Digital Prime Technologies expands Tokenet to BitGo Bank & Trust

Digital Prime Technologies, a provider of digital asset technology solutions and developer of Tokenet, today announced the completion of Tokenet's integration with BitGo Bank & Trust, National Association ("BitGo Bank & Trust"), an OCC-regulated digital asset trust bank and subsidiary of BitGo Holdings, Inc. (NYSE: BTGO) ("BitGo"), the digital asset infrastructure company.

Finextra
MEDIUMVulnerabilityNEW

Big payment names back new stablecoin

Visa, Mastercard, US Bank, Google and Coinbase are among dozens of firms backing Open USD, a new stablecoin slated to launch later this year.

Finextra
MEDIUMVulnerability

House passes kids’ online safety bill, but Senate approval unlikely

The Kids Internet and Digital Safety (KIDS) Act passed with bipartisan support by a 267-117 margin, winning the two-thirds majority needed to greenlight the legislation under a process that speeds up a bill’s path to a vote but requires more than a simple majority.

The Record