CVE-2026-87828

{"id": "CVE-2026-87828", "cveTags": [], "metrics": {}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Seraphinite Accelerator", "versions": [{"status": "affected", "version": "0", "lessThan": "2.29.24", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T06:16:35.137", "references": [{"url": "https://wpscan.com/vulnerability/ce546b34-4383-4166-9b87-335a524f37e2/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service)."}], "lastModified": "2026-09-16T20:25:29.240", "sourceIdentifier": "contact@wpscan.com"}