CVE-2026-87828
The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).
- Published Sep 16, 2026
- CVSS 5.7 medium
- 0.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available