CVE-2026-12083 is a privilege escalation vulnerability in the Admin and Site Enhancements (ASE) WordPress plugin, versions before 8.8.4, including version 7.6.3. The plugin fails to perform necessary authentication, authorization, or nonce validation on a role-restoration request handler. This allows unauthenticated attackers to reinstate administrator privileges to accounts that were previously demoted. The issue is a partial regression or incomplete fix of earlier CVEs that addressed only certain demotion paths in the WordPress role API. No CVSS score or official remediation level is provided, and no patch link is available at this time.

An unauthenticated attacker can escalate privileges by restoring a demoted administrator account to full administrator status. This can lead to complete site compromise, including unauthorized administrative actions. The vulnerability undermines the integrity of role management within the affected plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's functionality and monitor for suspicious activity related to role changes. Avoid using affected versions, such as 7.6.3, in production environments.