Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75860— JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update

Quick assessment

Affected
Unknown JSON Options
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress JSON Options 插件 0.0.4 版本在其某个动作中未进行任何权限检查（capability check）或非ces 验证（nonce verification），该动作在每个请求中都会执行，且对所有未认证用户开放。这使得未认证用户可以更新任意 WordPress 选项。攻击者可利用此漏洞启用用户注册功能，并将默认角色设置为管理员，从而引发权限提升，最终导致整个网站被接管。

AI Predicted 9.8 Difficulty: Trivial EPSS 0.34% · P27

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown JSON Options ≤ 0.0.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75860

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update
Source: CVE Program / CVE List V5
Vulnerability Description
The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown JSON Options 0 ~ 0.0.4 -

II. Public POCs for CVE-2026-75860

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75860

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-75860 (1)

Same Patch Batch · Unknown · 2026-08-20 · 7 CVEs total

CVE-2026-74992 Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
CVE-2026-19699 GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure
CVE-2026-19615 Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC
CVE-2026-19697 GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload
CVE-2026-15049 Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import
CVE-2026-13405 Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder

IV. Related Vulnerabilities

Same vendor: Unknown

V. Comments for CVE-2026-75860

No comments yet

Leave a comment