Unauthenticated WordPress Option Overwrite Leads to Admin Takeover

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Component WordPress plugin through version 2.2.4 contains a critical privilege escalation vulnerability that allows unauthenticated attackers to modify any WordPress site option without authentication or authorization verification. By exploiting missing capability and nonce checks on an exposed action, attackers can inject malicious data into the WordPress options table—including enabling user registration with administrator privileges. This vulnerability affects any WordPress installation using the vulnerable plugin, with single-site installations facing complete compromise and multi-site installations potentially exposed depending on configuration. The CVSS 9.8 critical rating reflects the ease of exploitation (no authentication required) combined with complete loss of confidentiality, integrity, and availability.

Casky's 224 matching security skills detect the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK technique TA0004 (Privilege Escalation) and analyzing indicators of improper input validation and authorization weaknesses. Practitioners using Casky would identify detection opportunities across multiple skill dimensions: monitoring for HTTP requests to WordPress action handlers lacking proper nonce validation, tracking unexpected modifications to WordPress options via direct database queries or wp_options API calls, detecting automated user account creation with administrative roles following option table modifications, and identifying requests that bypass standard WordPress authentication flows. The extended reasoning capability helps practitioners understand the attack chain—from initial reconnaissance of accessible actions through option enumeration to privilege escalation via role assignment—enabling them to craft detection rules that catch both the exploitation attempts and post-compromise lateral movement patterns associated with this vulnerability class.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-85681.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-85681

Casky has 224 skills that investigate the attack patterns behind CVE-2026-85681. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn