CVE-2026-111114: CWE-269 Improper Privilege Management in posimyththemes Nexter Extension – Security, Performance, Code Snippets & Site Toolkit

CVE-2026-111114 is a privilege escalation vulnerability in the Nexter Extension plugin for WordPress (versions <=4.7.11). The issue occurs because the `/?reset-view` handler in the `role_switcher_to_view_admin_as()` function does not perform nonce or capability checks when the username matches the authenticated user. Additionally, the plugin's cleanup hook (`profile_update`) does not fire during bulk role changes via `wp-admin/users.php?action=promote`, which directly calls `WP_User::set_role()` and leaves a stale 'administrator' role stored in user meta (`nxtext_view_admin_original_role`). An attacker who was previously an administrator and used the View Admin Role Switcher feature can exploit this by being demoted through the bulk role change, then restoring the stale administrator role to escalate privileges back to Administrator.

An authenticated user with Subscriber-level access or higher can escalate their privileges to Administrator if their account previously held Administrator rights and used the View Admin Role Switcher feature before being demoted via the bulk role change mechanism. This allows unauthorized administrative control over the WordPress site, potentially leading to full site compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the bulk role change feature to demote users who previously held Administrator roles and used the View Admin Role Switcher. Monitor plugin updates from posimyththemes for a security patch addressing this issue.