Description

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-20T06:17:32.207Z",
  "pubdate": "2026-08-20T06:17:32.207Z",
  "executiveSummary": "The JSON Options WordPress plugin suffers from an unauthenticated arbitrary option update vulnerability due to a complete absence of security controls.\nSpecifically, versions through 0.0.4 fail to perform any capability checks or nonce verification on one of its actions.\nBecause this action executes on every HTTP request and is accessible to unauthenticated remote adversaries, attackers can manipulate internal application settings without restrictions.\nThe primary impact of this vulnerability is critical privilege escalation leading to a full site takeover.\nBy leveraging this flaw, an unauthenticated attacker can modify core WordPress configuration settings, such as enabling user registration and altering the default user role to administrator.\nThe exploitation requirements are minimal, as no prior authentication, special privileges, or user interaction are necessary.\nThe risk implications are severe, as successful exploitation grants complete administrative control over the underlying WordPress installation, potentially compromising the entire server environment hosting the application.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure design of the JSON Options WordPress plugin through version 0.0.4, which exposes an internal action running on every HTTP request without implementing fundamental access control mechanisms.\nThe vulnerable component lacks both capability checks (such as current_user_can()) and cryptographic nonce verification (such as wp_verify_nonce()), which are standard security requirements in WordPress plugin development to prevent unauthorized state-changing operations.\nNetwork exposure is absolute; the vulnerable action is exposed globally over HTTP/HTTPS to unauthenticated users interacting with the web application.\nAuthentication and privilege requirements are entirely absent, allowing any remote anonymous user to interact with the vulnerable endpoint.\nThe exploitation method relies on sending crafted HTTP requests that trigger the vulnerable action hook during the application lifecycle.\nThe payload behavior involves supplying arbitrary key-value pairs representing WordPress options, which the insecure codebase then processes and updates within the database via internal option-updating functions.\nThe step-by-step attack flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP request targeting the WordPress site where the JSON Options plugin is active. Second, the request triggers the execution of the plugin action, which runs automatically on every request. Third, due to the complete lack of input validation, authorization checks, and anti-CSRF tokens, the plugin accepts attacker-supplied parameters intended for option modification. Fourth, the application updates critical database records associated with WordPress configuration settings. Specifically, the attacker alters the users_can_register option to true and changes the default_role option to administrator.\nThe post-exploitation impact allows the attacker to subsequently navigate to the public registration page, create a new user account, and automatically inherit administrative privileges upon registration.\nWith full administrative access achieved, the attacker can execute arbitrary code, upload malicious plugins or themes, modify database contents, and achieve complete compromise of the web server."
}