CVE-2026-7641

A WordPress plugin for managing users and customers contains a security flaw that allows attackers to gain elevated privileges within a Multisite network. The issue arises from a missing blocklist in the plugin's code, which fails to restrict certain capability meta keys for subsites, allowing them to be written directly to user meta. This vulnerability can be exploited by authenticated users with Subscriber-level access or higher, who can submit a manipulated profile update to elevate their privileges to Administrator on any subsite.

Based on public CVE data (MITRE/NVD).