Admin And Site Enhancements Ase
Monthly
The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.
Authenticated users with insufficient access control restrictions in Admin and Site Enhancements (ASE) versions 8.4.0 and earlier can bypass authorization checks to read and modify sensitive data. The vulnerability stems from improperly configured access control levels that fail to enforce proper privilege boundaries. An attacker with valid credentials can exploit this to gain unauthorized access to protected functionality without elevated permissions.
The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.
Authenticated users with insufficient access control restrictions in Admin and Site Enhancements (ASE) versions 8.4.0 and earlier can bypass authorization checks to read and modify sensitive data. The vulnerability stems from improperly configured access control levels that fail to enforce proper privilege boundaries. An attacker with valid credentials can exploit this to gain unauthorized access to protected functionality without elevated permissions.