CVE-2026-75860 Overview
CVE-2026-75860 is a critical vulnerability in the JSON Options WordPress plugin through version 0.0.4. The plugin exposes an action that runs on every request without capability checks or nonce verification. Unauthenticated attackers can invoke this action to update arbitrary WordPress options. Attackers weaponize this primitive by enabling user registration and setting the default role to administrator. This chain leads to privilege escalation and complete site takeover. The weakness is classified as improper privilege management [CWE-269].
Critical Impact
Unauthenticated attackers can modify arbitrary WordPress options to enable registration with administrator defaults, resulting in full site compromise.
Affected Products
- JSON Options WordPress plugin versions up to and including 0.0.4
- WordPress installations with the vulnerable plugin activated
- Any hosting environment exposing the affected WordPress site to the network
Discovery Timeline
- 2026-08-20 - CVE-2026-75860 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75860
Vulnerability Analysis
The JSON Options plugin registers a handler that executes on every WordPress request. The handler processes option updates without validating the caller's capability or verifying a WordPress nonce. Because the hook fires for unauthenticated visitors, any attacker who can reach the site can trigger option changes. The update_option primitive in WordPress accepts arbitrary option names and values, giving attackers wide control over site configuration. The vulnerability is a classic broken access control flaw combined with missing CSRF protection.
Root Cause
The root cause is the absence of authorization and request-origin checks on a sensitive administrative action. WordPress plugins that mutate options must call current_user_can() and wp_verify_nonce() before applying changes. The JSON Options plugin omits both controls in its request handler. The action is also wired to a hook that runs for anonymous traffic, expanding the attack surface to the entire internet.
Attack Vector
An attacker sends a crafted HTTP request to the target WordPress site containing the plugin's action parameters and the option name-value pairs to modify. Setting users_can_register to 1 opens self-registration. Setting default_role to administrator grants administrator privileges to every new account. The attacker then registers a standard user through wp-login.php?action=register and inherits full administrator access. From that point the attacker can install malicious plugins, upload PHP webshells, or exfiltrate data. Technical details are documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-75860
Indicators of Compromise
- Unexpected changes to the users_can_register option in wp_options, especially transitions from 0 to 1
- The default_role option set to administrator instead of the WordPress default of subscriber
- New administrator accounts created shortly after suspicious POST or GET traffic to the site root
- Plugin, theme, or file uploads originating from newly registered accounts
Detection Strategies
- Query the WordPress database periodically to baseline critical options such as users_can_register, default_role, siteurl, and home
- Alert on WordPress user_register events followed by role elevation or plugin installation within a short window
- Inspect web server access logs for anonymous requests carrying the JSON Options plugin's action parameter
Monitoring Recommendations
- Forward WordPress audit logs and web server logs to a centralized SIEM for correlation
- Enable file integrity monitoring on wp-content/plugins and wp-content/uploads to catch webshell deployment
- Track administrator account creation and privilege changes as high-severity events
How to Mitigate CVE-2026-75860
Immediate Actions Required
- Deactivate and remove the JSON Options plugin from all WordPress installations until a fixed version is released
- Audit the wp_users and wp_usermeta tables for unauthorized administrator accounts and remove any that are not legitimate
- Reset credentials for all administrator accounts and rotate WordPress secret keys in wp-config.php
- Verify that users_can_register and default_role reflect intended values
Patch Information
No patched version is listed in the referenced advisory at the time of publication. The vulnerability affects the JSON Options plugin through version 0.0.4. Consult the WPScan Vulnerability Report for updated remediation guidance.
Workarounds
- Remove the plugin directory from wp-content/plugins/ to eliminate the vulnerable code path
- Deploy a web application firewall rule blocking unauthenticated requests that carry the plugin's action parameter
- Restrict access to wp-login.php?action=register at the reverse proxy or WAF layer to prevent account creation
# Configuration example: disable registration and reset default role via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin deactivate json-options
wp plugin delete json-options
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
