Unauthenticated Admin Role Restoration in WordPress ASE Plugin

The Admin and Site Enhancements (ASE) WordPress plugin versions before 8.8.4 contain a critical authentication bypass vulnerability that allows unauthenticated attackers to restore demoted administrator accounts to full admin privileges. This vulnerability affects both the free and pro versions of the plugin and represents an incomplete patch of previous CVE-2024-43333 and CVE-2025-24648. The issue stems from missing authentication, authorization, and nonce validation on a role-restoration request handler, meaning any attacker without credentials can exploit multiple demotion API paths to regain or escalate privileges. With a CVSS score of 8.1, this poses significant risk to WordPress installations using ASE, as successful exploitation grants full administrative control and enables lateral movement, data exfiltration, and persistent backdoor placement.

While Casky currently shows zero matching skills for this specific CVE, practitioners using Casky's extended reasoning capabilities would detect the attack patterns through the underlying security principles mapped to MITRE ATT&CK. Detection would focus on identifying unauthenticated requests to administrative endpoints (T1078: Valid Accounts, T1087: Account Discovery), anomalous privilege escalation without corresponding authentication logs (T1548: Abuse Elevation Control Mechanism), and suspicious role modification API calls lacking proper session validation. Security teams leveraging Casky's 754-skill framework would search for authentication and authorization bypass patterns, HTTP requests to wp-admin or plugin endpoints lacking valid nonces, and database queries modifying user role metadata without corresponding login sessions—all indicators of CVE-2026-12083 exploitation attempts.