CVE-2026-105894

Name of the Vulnerable Software and Affected Versions Ak Framework plugin for WordPress versions prior to 2.9.9

Description Unauthenticated attackers can escalate privileges to administrator by updating arbitrary WordPress options. This occurs because the ajax refresh nonce and ak admin ajax handlers fail to perform capability checks before passing attacker-controlled option names and values to the update option() function. By manipulating these handlers, an attacker can enable user registration and set the default role to administrator via the users can register and default role variables.

Recommendations Update the Ak Framework plugin to version 2.9.9 or later.