PT-2026-20629 · WordPress · Toret Manager

Vgo0 · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2026-0912

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Toret Manager plugin for WordPress versions up to and including 1.2.7

Description The Toret Manager plugin for WordPress has a flaw that allows unauthorized modification of data, potentially leading to privilege escalation. This is due to a missing capability check in the trman save option and trman save option items functions. Authenticated attackers with Subscriber-level access or higher can update arbitrary options on the WordPress site. This can be used to change the default role for registration to administrator and enable user registration, allowing attackers to gain administrative user access.

Recommendations Update the Toret Manager plugin to a version newer than 1.2.7.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2026-0912

Produtos afetados

Toret Manager

Referências · 7

• https://plugins.trac.wordpress.org/browser/toret-manager/tags/1.2.7/admin/class-toret-manager-admin.php#L227 · Nota
• https://twitter.com/CVEnew/status/2025892073237250409 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0912 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3464839/toret-manager · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/4b2fc891-f3c6-4f4f-ad52-0a1a949eed25?source=cve · Nota
• https://twitter.com/CveTodo/status/2024533297749991519 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/toret-manager/tags/1.2.7/admin/class-toret-manager-admin.php#L210 · Nota