CVE-2026-57661

A Broken Access Control vulnerability exists in the WordPress WPComplete plugin in versions up to and including 2.9.5.5. The plugin fails to enforce proper authorization checks and is missing nonce token validation on a sensitive function, allowing any authenticated user with at least Subscriber-level access to perform actions that should be restricted to higher-privileged roles.

This vulnerability is classified under OWASP A1: Broken Access Control and has been observed in mass-exploit campaigns targeting WordPress sites at scale regardless of their size or traffic.

WPComplete is a course completion plugin for WordPress used to track learner progress. The affected code path exposes a function that processes privileged actions without verifying the caller's role or validating a nonce token.

The missing authorization check (CWE-862) means any Subscriber-level user can trigger functionality reserved for Administrators or Editors — such as marking courses complete for arbitrary users, modifying completion data, or altering plugin configuration.

Attack vector: Authenticated network request from a low-privilege Subscriber account targeting the unprotected endpoint. No special conditions or user interaction required beyond authentication.

• Unauthorized manipulation of course completion records for any user
• Privilege escalation of actions beyond the Subscriber role
• Potential data integrity issues in LMS/course tracking workflows
• Exploitation at scale via automated mass-exploit campaigns

Update WPComplete to version 2.9.5.6 or later. The patched version introduces proper capability checks and nonce validation on the affected function.

Sites unable to update immediately should restrict Subscriber-level registration or disable the WPComplete plugin until the patch can be applied. Contact your hosting provider or web developer if you need assistance.

• Patchstack Database — CVE-2026-57661
• CVE-2026-57661 — NVD / CVE.org
• WPComplete — WordPress.org Plugin Page

Discovered and responsibly disclosed by Md Minaruzzaman Shovon, full-stack developer and security researcher based in Bangladesh. Verified on Patchstack.