{"affected":[{"defaultStatus":"unknown","product":"Cool Media Filter","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-87784","cwes":["CWE-269"],"description":"The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/16788a03-d95b-4675-868a-dd56cc3365b6/"}],"kev":null,"metrics":[],"modifiedAt":1793944826902,"publishedAt":1793944826902,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/16788a03-d95b-4675-868a-dd56cc3365b6/"}],"remediation":[],"revision":"93b6d2293dbd61a188b18bac4b4faab287c8162e132f35196596168d8fd00baf","sources":[{"modifiedAt":1793944826902,"name":"CNA: WPScan","retrievedAt":1793945355840,"url":"https://www.cve.org/CVERecord?id=CVE-2026-87784"}],"ssvc":null,"status":"published","title":"Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission","updatedAt":1793945355840}