JSON Options EUVD-2026-63207

The required precondition is that the target WordPress site has the JSON Options plugin (version ≤0.0.4) installed and active, since the vulnerable action is registered to run on every request; no authentication, user interaction, or non-default WordPress configuration is otherwise needed (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is plugin prevalence rather than exploit difficulty: only sites actually running this specific plugin are exposed. To fully weaponize into an admin account the attacker relies on WordPress's standard self-registration flow being reachable after they enable it, which the vulnerability itself provides by writing users_can_register and default_role.

The signals are largely aligned toward high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) indicates trivial remote, unauthenticated, no-interaction exploitation with total impact, and SSVC corroborates this with Automatable:yes and Technical Impact:total - meaning an attacker can reliably script mass exploitation across many sites. Public exploit code exists (WPScan), which raises practical risk further. The main tempering signal is SSVC Exploitation:none and the absence of a CISA KEV listing, so there is no confirmed evidence of active in-the-wild exploitation yet; combined with the likely small deployment footprint of this plugin, real-world exposure is probably limited to the subset of sites that actually run it. On balance this is a genuine high-priority issue for any operator running JSON Options - the low complexity plus automatability means that if the plugin is installed, it should be treated as urgent rather than as a high-CVSS-but-low-real-risk case; there is no conflict between the CVSS vector and the description, both of which point to unauthenticated remote option tampering.

An attacker discovers a site running JSON Options and, without any credentials, sends a crafted request that triggers the unguarded option-update action to set users_can_register=1 and default_role=administrator. They then register a normal account through wp-login.php, which WordPress grants administrator privileges, giving full control to upload malicious plugins/themes and run code. Public exploit code from WPScan makes this scenario low-effort and automatable at scale.