CVE-2026-0912: Privilege Escalation in Toret Manager

The core of this vulnerability lies in the absence of proper capability checks within the trmansaveoption and trmansaveoption_items functions. This oversight permits authenticated users, even those with limited privileges like Subscriber, to manipulate critical WordPress configuration settings. A malicious actor could exploit this to update the default user role for new registrations to 'administrator,' effectively granting themselves full administrative access upon account creation. This bypasses standard WordPress security measures and allows for complete control over the site, including data modification, installation of malicious code, and account compromise. The potential blast radius is significant, as a successful exploitation could compromise the entire WordPress instance and any associated data.

1. Reserved2026-01-13
2. Published2026-02-19
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0912 is to immediately upgrade the Toret Manager plugin to version 1.3.0 or later. If upgrading is not feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the plugin's settings pages to prevent unauthorized modifications. While not a complete solution, implementing a Web Application Firewall (WAF) rule to block requests to the trmansaveoption and trmansaveoption_items endpoints with insufficient user capabilities could offer a temporary layer of protection. Regularly review WordPress user roles and permissions to ensure they adhere to the principle of least privilege.