CVE-2026-12083
The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.
Published:Jul 6, 2026
Last Modified:Nov 10, 2026
EPS:Jul 6, 2026
EPSS Score:0.00468
CVSS Score:8.1
Affected Products
Vendor
Product
Action
Vendor
Wordpress-extensions
Product
Admin-site-enhancements-pro
Wordpress-extensions
Admin-site-enhancements-pro
Vendor
Wordpress-extensions
Product
Admin And Site Enhancements
Wordpress-extensions
Admin And Site Enhancements
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
