CVE-2026-75860 in JSON Options Plugin
Summary
by MITRE • 08/20/2026
The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in JSON Options for WordPress versions up to 0.0.4 represents a critical failure in access control mechanisms within the plugin's architecture. The core issue stems from the absence of capability checks and nonce verification on specific action handlers that are executed during every request cycle. In standard WordPress development practices, any function or endpoint that modifies site configuration must verify that the requesting user possesses the necessary administrative privileges via capabilities such as manage_options. Furthermore, nonces are essential for preventing Cross-Site Request Forgery attacks by ensuring that requests originate from legitimate sources and have not been tampered with. The lack of these security controls means that the affected action is effectively exposed to any actor on the internet without requiring authentication or valid session tokens. This design flaw fundamentally undermines the integrity of the WordPress option system, which serves as the central repository for site configuration data including user settings, theme preferences, and plugin states.
From a technical perspective, this vulnerability allows unauthenticated attackers to manipulate arbitrary WordPress options by sending crafted HTTP requests directly to the vulnerable endpoint. Since there is no validation of the request's origin or the requester's identity, an attacker can inject malicious payloads into the option values. The most severe consequence of this unrestricted write access is the ability to alter user registration settings and role assignments. By modifying specific configuration keys, an attacker can enable public user registration on a site that was previously closed to new users. More critically, they can set the default role for newly registered accounts to administrator. This transformation effectively creates a backdoor into the system because it allows any individual who visits the registration page to create an account with full administrative privileges. Once these elevated credentials are obtained, the attacker gains complete control over the WordPress installation, including access to all plugins, themes, database contents, and server-side files if further exploitation chains exist.
The operational impact of this vulnerability is severe, leading directly to a total compromise of the affected website's confidentiality, integrity, and availability. Privilege escalation through this method bypasses traditional authentication barriers entirely, making it particularly dangerous for sites that do not actively monitor user creation logs or have strict registration policies enabled by default. An attacker leveraging this flaw can install malicious plugins, deface the site frontend, exfiltrate sensitive data stored in the database, or use the compromised server as a pivot point for further network attacks. The ease of exploitation means that automated bots scanning for vulnerable WordPress installations can compromise thousands of sites rapidly without any manual intervention. This type of vulnerability aligns with CWE-284 Improper Access Control and CWE-352 Cross-Site Request Forgery, reflecting the fundamental failures in verifying user authority and request authenticity. Additionally, from a threat intelligence perspective using MITRE ATT&CK frameworks, this behavior corresponds to techniques involving Account Manipulation for persistence and Privilege Escalation to gain higher-level access within the system environment.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade the JSON Options plugin to a version that has patched these security flaws by implementing proper capability checks using functions like current_user_can with appropriate capabilities such as manage_options or edit_posts depending on the scope of the action. Nonce verification should also be integrated into all state-changing operations to prevent CSRF attacks. For sites unable to update immediately, administrators can disable user registration entirely through the WordPress dashboard settings if not required for business logic. Additionally, implementing a Web Application Firewall with rules that detect and block suspicious patterns in option updates or unauthorized API calls can provide an additional layer of defense. Regular security audits focusing on input validation and access control verification are essential to prevent similar vulnerabilities from being introduced during future plugin development cycles.