Nexter Extension EUVD-2026-102648

Exploitation is tightly constrained: the attacker must be authenticated at Subscriber level or above (PR:L), AND their account must previously have held the Administrator role, AND must have used the plugin's 'View Admin Role Switcher' feature, AND must subsequently have been demoted specifically via the wp-admin/users.php?action=promote bulk role-change control (which calls WP_User::set_role() directly) rather than via the Edit User screen. Only the bulk path bypasses the profile_update hook that would otherwise clear the stored original role, so a stale 'administrator' value remains in the nxtext_view_admin_original_role user meta. The actual trigger is the /?reset-view handler in role_switcher_to_view_admin_as(), which performs no nonce or capability check when the supplied username matches the authenticated caller. The limiting factors - the attacker-uncontrolled demotion path, the requirement of a prior Administrator history, and prior use of the role-switcher feature - are why AC is High and why typical fresh low-privilege accounts cannot exploit this.

Signals conflict, and the net real-world risk is lower than the 7.5 (HIGH) base score suggests. The CVSS vector itself encodes the key limiter: AC:H and PR:L mean exploitation requires authentication (Subscriber or above) AND a narrow, attacker-uncontrolled precondition chain. CWE-269 and the description confirm the genuine impact is full Administrator takeover (C:H/I:H/A:H), which is severe IF reachable. However, reachability is gated by an unusual prerequisite: the attacker's own account must have previously held Administrator, must have used the View Admin Role Switcher feature, and must then have been demoted specifically via the wp-admin bulk 'promote' path (not the Edit User screen) so a stale 'administrator' value survives in nxtext_view_admin_original_role user meta. This is an operator-created, order-of-events condition, not something an ordinary low-privileged attacker can arrange on demand. No EPSS score was provided in the input and the CVE is not listed in CISA KEV; no public exploit code is referenced - only the Wordfence advisory and source-code line references. There is therefore no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimately high-impact privilege-escalation bug but with real-world likelihood materially reduced by the AC:H precondition chain, making it a patch-soon rather than drop-everything priority. Note the reporter (Wordfence) and vendor source are consistent; no signal conflicts the vector itself, but EPSS and exploitation telemetry are simply absent and should not be inferred.

An employee or contributor whose account was once an Administrator used the plugin's View Admin Role Switcher, then was demoted through the Users screen 'Change role to...' bulk control, leaving a stale administrator value in their user meta. Still logged in as a Subscriber-level user, they invoke the /?reset-view handler for their own username, which performs no nonce or capability check when the username matches the caller, and the plugin restores them to Administrator. No public exploit code is referenced for this CVE.