CVE-2026-0912Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Toret Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'trman_save_option' function and on the 'trman_save_option_items' in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://cvetodo.com/cve/CVE-2026-0912

Full discourse1 post

CVETodo@CveTodo233d
Disclosure
CVE-2026-0912 pertains to a security flaw within the Toret Manager plugin for WordPress, specifically affecting all versions up to and including 1.2.7. The core issue is a missing capability check in the functions `trman_save_option` and `trman_save_option_items`. This omission allows authenticated users with Subscriber-level access or higher to modify arbitrary options within the plugin, which can lead to privilege escalation. #Cybersecurity #CVE #HighSeverity #SecurityAlert #RemoteCodeExecution #PrivilegeEscalation #Apple https://cvetodo.com/cve/CVE-2026-0912
Post summary
CVE‑2026‑0912 is a privilege escalation flaw in the Toret Manager WordPress plugin caused by missing capability checks, affecting all versions up to 1.2.7 and allowing authenticated users to modify arbitrary plugin options.
0000028
20 followersView on X

Explore more

Back to dashboard