EUVD-2026-63207
GHSA-8hgw-w4m4-6hmx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable action with no interaction (PR:N/UI:N/AV:N/AC:L); arbitrary option write enables admin takeover, giving full confidentiality, integrity, and availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.
Articles & Coverage 1
AnalysisAI
Full site takeover in the JSON Options WordPress plugin (versions through 0.0.4) is possible because one of its actions runs on every request without any capability check or nonce verification, exposing arbitrary WordPress option updates to unauthenticated users. An attacker can flip the users_can_register option on and set default_role to administrator, then self-register an admin account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The required precondition is that the target WordPress site has the JSON Options plugin (version ≤0.0.4) installed and active, since the vulnerable action is registered to run on every request; no authentication, user interaction, or non-default WordPress configuration is otherwise needed (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely aligned toward high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers a site running JSON Options and, without any credentials, sends a crafted request that triggers the unguarded option-update action to set users_can_register=1 and default_role=administrator. They then register a normal account through wp-login.php, which WordPress grants administrator privileges, giving full control to upload malicious plugins/themes and run code. … |
| Remediation | No vendor-released patch identified at time of analysis - the plugin is reported vulnerable through its latest version 0.0.4, so no fixed release can be cited. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately identify all WordPress installations running JSON Options plugin; disable the plugin on every affected site and document affected assets. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today