Vulnerability · Published Jul 6, 2026 · Assigned by WPScan

CVE-2026-12083Admin and Site Enhancements < 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for Parameter

High 8.1

In plain English

A high-severity security flaw in Admin and Site Enhancements (ASE) from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 59.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Admin and Site Enhancements (ASE)	7.6.3 – before 8.8.4
Unknown	admin-site-enhancements-pro	7.6.3 – before 8.8.4

References

https://wpscan.com/vulnerability/a0c94f7f-6314-4ff2-bb92-ec02146975ff/ exploit, vdb-entry, technical-description