CVE-2026-75860 JSON Options CVE debrief

Who should care

WordPress site administrators, security teams, and users of the JSON Options WordPress plugin should be aware of this critical vulnerability and take immediate action to update the plugin and monitor their sites for potential exploitation. Affected operators and platforms require urgent review and mitigation to prevent potential privilege escalation and full site takeover.

Technical summary

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover. Affected product context indicates that WordPress site administrators and security teams should be aware of this critical vulnerability.

Defensive priority

CVE-2026-75860 is a critical vulnerability in the JSON Options WordPress plugin, allowing unauthenticated users to update arbitrary WordPress options, potentially leading to privilege escalation and full site takeover.

Recommended defensive actions

• Review and update the JSON Options WordPress plugin to version above 0.0.4
• Implement additional authentication and authorization checks for WordPress options updates
• Monitor WordPress site activity for suspicious option updates
• Consider using a Web Application Firewall (WAF) to detect and prevent exploitation attempts
• Perform regular security audits and vulnerability assessments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover. Evidence is limited, and defenders should verify affected deployments, review official advisories, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.