CVE-2026-105894

The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). This makes it possible for unauthenticated attackers to update arbitrary WordPress options including users_can_register and default_role to escalate privileges to administrator by enabling user registration with administrator as the default role.

• CWE-269

• https://docs.akbilisim.com/newsy/changelog/#v299
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d9f99ab9-eb22-4766-81f2-647af1229815?source=cve

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105889Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2026-10589A potential out of bounds write vulnerability could allow a …6.8
• CVE-2026-105890Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-105891Missing Authorization vulnerability in Liquid Web / StellarW…4.3
• CVE-2026-105892Improper Limitation of a Pathname to a Restricted Directory …9.8
• CVE-2026-105893Authorization Bypass Through User-Controlled Key vulnerabili…5.3
• CVE-2026-105895Adobe Experience Manager is affected by an Improper Input Va…9.9
• CVE-2026-105896Photoshop Desktop is affected by a NULL Pointer Dereference …5.5
• CVE-2026-105897ColdFusion is affected by a Server-Side Request Forgery (SSR…8.6
• CVE-2026-105898ColdFusion is affected by an Incorrect Authorization vulnera…8.2
• CVE-2026-105899ColdFusion is affected by an Unrestricted Upload of File wit…10
• CVE-2026-1059A security vulnerability has been detected in FeMiner wms up…9.8