Backstage Plugin CVE-2026-9842

Exploitation requires the Backstage - Customizer Demo Access plugin (≤1.4.2) to be installed and its Customizer demo feature active and reachable, since the attack rides the backstage_customizer_user demo role that receives manage_options. Given AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special client configuration is needed once the demo endpoint is exposed - the concrete prerequisite is simply the ability to initiate a demo Customizer session and issue an option-update request targeting keys such as default_role. The main limiting factor is deployment-specific: sites without the plugin, or where demo access is disabled or not externally reachable, are not exploitable, and full account takeover additionally depends on abusing registration settings (default_role/users_can_register) after the option write.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated attack with high integrity impact and no confidentiality or availability impact - consistent with silently altering site configuration rather than reading data or causing downtime. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so the score reflects theoretical severity rather than observed exploitation. The practical caveat is that PR:N assumes the demo-access feature is actively serving a demo session an attacker can reach; the whole vulnerability is contingent on the plugin's demo functionality being enabled and exposed, which is its intended purpose but still a deployment-dependent condition. Given a niche plugin with no evidence of in-the-wild activity, this is a genuine unauthenticated-privilege-escalation issue worth patching but likely of targeted rather than mass-exploitation interest. Confidentiality is scored N, yet a successful escalation to an admin-capable role would indirectly expose data - the base vector captures only the direct option-write impact.

An attacker browses to a WordPress site running Backstage with demo access enabled and starts a Customizer demo session, obtaining the backstage_customizer_user role that improperly holds manage_options. Using that capability, the attacker submits an option-update request to change default_role to administrator and enable open registration, then registers a new account that is automatically granted administrator privileges. No public POC is referenced, but the low-complexity, unauthenticated network vector makes the sequence straightforward for anyone who can reach the demo flow.