Blog JSON Options gives admin to anyone, and four more plugin fixes

JSON Options gives admin to anyone, and four more plugin fixes

An unauthenticated action in JSON Options lets any visitor flip on user registration and set the default role to administrator. rtMedia, Events Made Easy and Depicter ship fixes; Persistent Login has none.

Segurium 3 min read
  • wordpress
  • plugin
  • cve
  • exploit

The worst item today is json-options. NVD confirms that one of the plugin’s actions runs on every request, has no capability check, and has no nonce. An unauthenticated visitor can call it and change any WordPress option. The description spells out the takeover path: turn on user registration, set the default role to administrator, register, log in. Version 0.0.4 is the last one that exists, and no fix has been published.

The rest of the day follows the same shape. Four more plugins, four more bugs where the check that should have been there was not. Three of them have a fix. Two do not.

json-options up to 0.0.4, unpatched

The plugin is not in the wordpress.org directory. That is not proof of anything on its own — the slug may be paid, renamed, or simply wrong — but it does mean there is no update button to press. If the plugin is on the site, remove it.

  • Affected: all versions through 0.0.4
  • CVE: CVE-2026-75860, CVSS 9.8
  • Impact: unauthenticated change to any WordPress option, leading to full site takeover
  • Fix: none published; remove the plugin
  • After removal: audit wp_users for accounts you did not create, and check users_can_register and default_role in wp_options

buddypress-media 4.7.12

rtMedia, the media plugin for BuddyPress and bbPress, had an unauthenticated SQL injection through 4.7.11. NVD confirms the class and the score. The current release on the directory is 4.7.12, published on August 18. Roughly 7,000 sites run it.

  • Affected: versions up to and including 4.7.11
  • CVE: CVE-2026-66592, CVSS 9.3
  • Fix: update to 4.7.12
  • After update: check request logs for odd UNION or SLEEP patterns against the plugin’s endpoints

events-made-easy 3.2.6

The eme_single_event_page_template function lets a contributor-level user include and run any .php file on the server. That includes files the attacker just wrote through some other route, so on a shared host with weak isolation this is a working path to code execution.

  • Affected: versions up to and including 3.2.5
  • CVE: CVE-2026-75963, CVSS 7.5
  • Fix: update to 3.2.6
  • After update: review contributor accounts and any PHP files under wp-content you did not put there

depicter 4.8.0

Depicter’s import feature did not check the type of the uploaded file, and did not remove a malformed upload. An editor could write an executable PHP file into a web-reachable folder. About 80,000 sites run this plugin, which is the largest install base in today’s set.

  • Affected: versions before 4.8.0
  • CVE: CVE-2026-15049, CVSS 7.2
  • Fix: update to 4.8.0
  • After update: look for .php files under the Depicter upload path, and treat any editor account whose activity you cannot explain as suspect

persistent-login up to 3.1.0, unpatched

A subscriber-level SQL injection through version 3.1.0. The slug has no entry on the wordpress.org directory, so there is no update route from the admin. Subscriber access is a low bar on any site that lets visitors sign up.

  • Affected: versions up to and including 3.1.0
  • CVE: CVE-2026-66594, CVSS 8.5
  • Auth: subscriber
  • Fix: none published; remove the plugin

Two of the five items today have no patch and no listing on the directory. That is the class of problem a scanner has to catch on the file system, because the update pipeline will never touch it.

Related

Tags: #wordpress , #plugin , #cve , #exploit