Toret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions

The core of this vulnerability lies in the absence of proper capability checks within the trmansaveoption and trmansaveoption_items functions. This allows authenticated users, even those with limited privileges like Subscriber, to bypass intended restrictions and directly manipulate WordPress configuration options. A malicious actor could leverage this to change the default user role for new registrations to 'administrator,' effectively granting themselves full control over the WordPress site upon a new user's creation. The potential blast radius extends to any site utilizing the vulnerable plugin version, making it a significant risk for WordPress deployments.

WordPress sites utilizing the Toret Manager plugin, particularly those with Subscriber-level users or those that allow user registration. Shared hosting environments where multiple WordPress installations share the same server resources are also at increased risk, as a compromise of one site could potentially lead to lateral movement to others.

• wordpress / plugin:

wp plugin list | grep toret-manager

• wordpress / plugin: Check plugin version in WordPress admin dashboard under Plugins. • wordpress / plugin: Examine the trmansaveoption and trmansaveoption_items functions in the plugin's code for missing capability checks. • wordpress / plugin: Monitor WordPress logs for suspicious activity related to option updates, particularly changes to the default user role. • wordpress / plugin: Use wp-cli to check for outdated plugin versions: wp plugin update --all

1. 2026-02-19Disclosure

   disclosure

1. Reserviert2026-01-13
2. Veröffentlicht2026-02-19
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation is to immediately upgrade the Toret Manager plugin to version 1.3.0 or later, which includes the necessary capability checks. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider restricting access to the plugin’s configuration options using a WordPress security plugin or custom code. Implement stricter user role assignments and regularly audit user permissions to detect any unauthorized changes. Monitor WordPress logs for suspicious activity related to option modifications, specifically targeting the trmansaveoption function.