CVE-2026-0912

Name of the Vulnerable Software and Affected Versions Toret Manager plugin for WordPress versions up to and including 1.2.7

Description The Toret Manager plugin for WordPress has a flaw that allows unauthorized modification of data, potentially leading to privilege escalation. This is due to a missing capability check in the trman save option and trman save option items functions. Authenticated attackers with Subscriber-level access or higher can update arbitrary options on the WordPress site. This can be used to change the default role for registration to administrator and enable user registration, allowing attackers to gain administrative user access.

Recommendations Update the Toret Manager plugin to a version newer than 1.2.7.