Description (CNA)
The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Admin and Site Enhancements (ASE) | affected 7.6.3 before 8.8.4 |
| Unknown / admin-site-enhancements-pro | affected 7.6.3 before 8.8.4 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.