CVE-2026-12083 is an improper privilege management vulnerability (CWE-269) in the Admin and Site Enhancements (ASE) WordPress plugin before version 8.8.4 and the admin-site-enhancements-pro plugin before 8.8.4. The plugin fails to enforce authentication, authorization, or nonce validation on a role-restoration request handler. This flaw enables unauthenticated attackers to escalate privileges by restoring a previously demoted administrator account to full administrator status. This vulnerability represents an incomplete remediation of prior CVEs (2024-43333 and 2025-24648) that only partially addressed the issue for certain demotion paths exposed by the WordPress role API.

Successful exploitation allows unauthenticated attackers to regain administrator privileges by restoring a demoted administrator account. This leads to full control over the affected WordPress site, including the ability to modify content, install plugins, change settings, and potentially compromise the entire site integrity and availability. The CVSS score of 8.1 reflects a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects versions before 8.8.4, so upgrading to version 8.8.4 or later is expected to address the issue once the vendor releases the fix. Until then, restrict access to the affected plugin's functionality and monitor for suspicious activity related to role changes. Avoid using affected versions in production environments.