What is the CVSS score of CVE-2026-12083?

CVE-2026-12083 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Admin Site Enhancements are affected by CVE-2026-12083?

A critical vulnerability in the Admin and Site Enhancements WordPress plugin allows unauthorized users to grant themselves administrator privileges without needing existing credentials, with publicly…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12083?

Yes, a public proof-of-concept exploit is available for CVE-2026-12083. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-12083?

Within 24 hours, audit all WordPress installations to identify those running the Admin and Site Enhancements plugin and document current versions; prioritize any instances running version 8.8.3 or earlier. Within 7 days, apply the vendor-released patch by updating the ASE plugin to version 8.8.4 or later across all affected installations, testing in staging environments first to ensure compatibility with active themes and other plugins. Within 30 days, conduct a post-patch security audit to verify administrator account logs for unauthorized role-restoration attempts and document any suspicious account modifications that occurred prior to patching.

Admin Site Enhancements CVE-2026-12083

EUVD-2026-41811 HIGH

2026-07-06 WPScan

GHSA-5xvm-frp3-hwwv

WordPress Information Disclosure Admin And Site Enhancements Ase Admin Site Enhancements Pro

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated remote handler (PR:N/AV:N/UI:N) but requires a pre-existing demoted-admin account, so AC:H; restoring admin yields total control, hence C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:19 vuln.today

Patch available

Jul 06, 2026 - 09:01 EUVD

CVE Published

Jul 06, 2026 - 06:00 cve.org

HIGH 8.1

CVE Published

Jul 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High, All With POC Jul 07, 2026

AnalysisAI

Privilege escalation in the Admin and Site Enhancements (ASE) WordPress plugin (free and Pro) before 8.8.4 lets unauthenticated attackers restore a previously demoted administrator account back to the administrator role, because the role-restoration request handler performs no authentication, authorization, or nonce validation. This is an incomplete-fix regression of CVE-2024-43333 / CVE-2025-24648, which only closed one of the two demotion paths exposed by the WordPress role API. Publicly available exploit code exists (WPScan), though EPSS is low (0.18%, 8th percentile) and it is not in CISA KEV, indicating no confirmed active exploitation at time of analysis.

Technical ContextAI

The affected component is a WordPress plugin that provides administrative hardening features, including the ability to demote or hide administrator accounts. The vulnerability lies in an AJAX/request handler that restores a demoted admin's role: it is missing the standard WordPress access-control triad - a capability check (current_user_can), authentication, and a nonce (wp_verify_nonce) - so any anonymous visitor can invoke it. The root cause is a broken/missing access control class of flaw (CWE-862 Missing Authorization combined with CWE-306 Missing Authentication and CWE-352 missing CSRF nonce); the NVD CWE field is unpopulated (N/A). The prior fixes for CVE-2024-43333 / CVE-2025-24648 guarded one demotion code path but not the second path the WordPress user-role API exposes, leaving the restoration routine reachable. CPE identifiers cover cpe:2.3:a:unknown:admin_and_site_enhancements_(ase) and cpe:2.3:a:unknown:admin-site-enhancements-pro, i.e. both the free and Pro editions.

RemediationAI

Vendor-released patch: upgrade both the free and Pro plugin to version 8.8.4 or later, which closes the remaining demotion path left open by the incomplete fixes for CVE-2024-43333 / CVE-2025-24648; this is the primary and complete remediation. If immediate patching is not possible, specific compensating controls include restricting access to wp-admin/admin-ajax.php and the plugin's action endpoint at the web-server or WAF layer to trusted IPs (trade-off: can break legitimate front-end AJAX for anonymous users), temporarily disabling the ASE administrator demotion/hide-admin feature or deactivating the plugin entirely (trade-off: removes the vulnerable handler but loses ASE's hardening features), and auditing the site's users to confirm no unexpectedly-restored administrator accounts exist, removing or re-demoting any that appear. Reference the WPScan advisory (https://wpscan.com/vulnerability/a0c94f7f-6314-4ff2-bb92-ec02146975ff/) for detection and confirmation details.