CVE-2026-15309

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax save settings() function, which accepts arbitrary POST parameters and calls update option() with attacker-controlled keys and values without any authorization verification. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges to administrator by setting the default role WordPress option to 'administrator' and users can register to '1', then registering a new account that is automatically granted full administrator access.