CVE-2026-75860: WordPress JSON Options Plugin Unauthenticated Options Update (CVSS 9.8)

Overview

A critical security vulnerability has been identified in the JSON Options WordPress plugin (versions through 0.0.4). The flaw, tracked as CVE-2026-75860 with a CVSS score of 9.8 (Critical), allows unauthenticated attackers to update arbitrary WordPress site options — a capability that can be leveraged for complete site takeover.

Vulnerability Details

The plugin registers an action hook that executes on every request without any capability check or nonce verification. Because this handler is accessible to unauthenticated users, an attacker can invoke it to modify any option stored in the WordPress wp_options table.

Key technical facts:

• No authentication required — the vulnerable endpoint is reachable by any HTTP client
• No CSRF protection — nonce verification is absent, enabling cross-site request attacks
• Arbitrary option write — attackers can set any WordPress option to any value
• Privilege escalation path — enabling open user registration and assigning an elevated default role grants administrative access

This class of vulnerability is particularly dangerous because it can be chained into full administrative compromise without ever touching an authenticated endpoint.

Impact

An unauthenticated remote attacker can:

1. Enable user registration (users_can_register = 1) on sites where it is disabled
2. Set default user role to administrator or editor, granting elevated access to any newly registered account
3. Modify critical settings such as siteurl, admin_email, or plugin configuration values
4. Facilitate further attacks — arbitrary option writes can enable malicious plugin uploads, redirect site traffic, or poison cached data

Sites running the affected plugin with public-facing WordPress installations are at highest risk.

Affected Versions

Remediation

• Remove or deactivate the JSON Options plugin immediately if installed. No patched version is publicly available as of the advisory publication date.
• Audit WordPress options for unexpected changes, particularly users_can_register, default_role, and siteurl.
• Review recent user registrations for unauthorized administrator-level accounts and revoke access if found.
• Enable a Web Application Firewall (WAF) rule to block requests targeting the vulnerable action if removal is not immediately possible.

References

• NVD Entry — CVE-2026-75860
• WordPress Plugin Repository
• WordPress Security Hardening Guide