Unauthorized Role Restoration in Admin Site Enhancements Plugin for WordPress
CVE-2026-12083

Currently unrated

Key Information:

Vendor

WordPress
Status
Admin And Site Enhancements (ase)
Admin-site-enhancements-pro
Vendor
CVE Published:
6 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-12083?

The Admin and Site Enhancements plugin for WordPress, both the standard and pro versions prior to 8.8.4, contains a significant vulnerability that permits unauthenticated attackers to exploit the role-restoration request handler. This flaw enables malicious users to reinstate administratively demoted accounts back to their prior administrator roles without the need for proper authentication, authorization, or nonce checks. This vulnerability is an incomplete fix of prior CVEs and poses a risk to WordPress site security by potentially allowing unauthorized users elevated privileges.

Affected Version(s)

Admin and Site Enhancements (ASE) 7.6.3 < 8.8.4

admin-site-enhancements-pro 7.6.3 < 8.8.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-12083 - Proof of Concept

References

https://wpscan.com/vulnerability/a0c94f7f-6314-4ff2-bb92-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Revanth Hari Narayana Matte
WPScan
.