Executive brief
A vulnerability in the Admin and Site Enhancements (ASE) WordPress plugin allows unauthorized individuals to restore administrative privileges to accounts that were previously demoted. This plugin is used to manage and optimize WordPress site administration. An attacker could exploit this to regain full control over a website if they target an account that was once an administrator, potentially leading to data theft or complete site takeover.
Technical details
The Admin and Site Enhancements (ASE) and ASE Pro plugins for WordPress fail to perform authentication, authorization, or nonce checks on the 'reset-for' request handler. This handler is part of the 'View Admin As Role' feature. An unauthenticated attacker can trigger a role restoration by sending a crafted request to the site root with the 'reset-for' parameter set to a target username. If that user was previously an administrator and was demoted via a non-profile_update path (such as WP-CLI or direct API calls), the plugin will restore their administrator role. This issue is an incomplete fix for previous vulnerabilities (CVE-2024-43333 and CVE-2025-24648). The vulnerability is fixed in version 8.8.4.
Affected products
- Unknown Admin and Site Enhancements (ASE) < 8.8.4
- Unknown admin-site-enhancements-pro < 8.8.4
Timeline
- 2026-06-15: disclosed
- 2026-07-06: advisory: NVD publication date