Admin Site Enhancements Pro
Monthly
Privilege escalation in the Admin and Site Enhancements (ASE) WordPress plugin (free and Pro) before 8.8.4 lets unauthenticated attackers restore a previously demoted administrator account back to the administrator role, because the role-restoration request handler performs no authentication, authorization, or nonce validation. This is an incomplete-fix regression of CVE-2024-43333 / CVE-2025-24648, which only closed one of the two demotion paths exposed by the WordPress role API. Publicly available exploit code exists (WPScan), though EPSS is low (0.18%, 8th percentile) and it is not in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Privilege escalation in the Admin and Site Enhancements (ASE) WordPress plugin (free and Pro) before 8.8.4 lets unauthenticated attackers restore a previously demoted administrator account back to the administrator role, because the role-restoration request handler performs no authentication, authorization, or nonce validation. This is an incomplete-fix regression of CVE-2024-43333 / CVE-2025-24648, which only closed one of the two demotion paths exposed by the WordPress role API. Publicly available exploit code exists (WPScan), though EPSS is low (0.18%, 8th percentile) and it is not in CISA KEV, indicating no confirmed active exploitation at time of analysis.