CVE-2026-87828: Unknown Seraphinite Accelerator

Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days.

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).

Affected products

• Unknown Seraphinite Accelerator: before 2.29.24 (fixed in 2.29.24)

Published 2026-09-16. Last modified 2026-09-17.