External risk intelligence

WordPress JSON Options Plugin Privilege Escalation Leading to Site Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-75860

The vulnerability resides in a WordPress plugin that handles requests from unauthenticated users on every page load. Because WordPress sites are typically public-facing web applications, this vulnerability is directly exposed to the public internet by design and is accessible without any authentication.

Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the JSON Options WordPress plugin that could allow unauthorized users to gain administrative control of affected websites. This issue arises because the plugin lacks proper security checks, enabling unauthenticated access to modify critical site settings. The primary concern is to confirm if this plugin is in use and assess potential exposure.

Unauthenticated users can alter site settings.
It enables unauthorized administrative control.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target any WordPress site using the vulnerable JSON Options plugin. By sending a crafted request, an attacker can manipulate critical WordPress settings without needing any special privileges or user interaction. This manipulation can then lead to attackers gaining administrative control over the entire website.

No authentication or privileges needed.
Triggers by sending a crafted request.
Results in full site takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to modify critical WordPress settings, such as enabling user registration and setting the default user role to administrator, leading to a complete takeover of the affected website.

Arbitrary WordPress options could be updated.
Unauthenticated users may trigger the action.
Full site takeover is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The JSON Options WordPress plugin vulnerability requires immediate attention from teams managing WordPress sites. Application owners or platform teams are likely responsible for the plugin's lifecycle, while security teams should verify exposure and assist with remediation. The first practical move involves identifying all WordPress instances using this plugin, confirming their internet reachability, and assessing business criticality to prioritize actions.

WordPress application owners should act.
Verify internet-facing instances first.
Plan remediation based on business risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the JSON Options WordPress plugin?

JSON Options is a plugin for WordPress designed to help site administrators manage and update various configuration settings in a structured JSON format. It essentially acts as a utility to simplify the modification of internal site options without requiring direct manual database changes.

What does CWE-269 mean for CVE-2026-75860?

CWE-269 refers to Improper Privilege Management. In this CVE, it means the plugin fails to verify if a user has the appropriate authority to perform an action. Because it lacks these checks, it grants unauthorized users the ability to change settings that should only be accessible to an administrator, effectively elevating their privilege level.

How is the CVE-2026-75860 vulnerability triggered?

The vulnerability is triggered when an unauthenticated user sends a specific, crafted request to the site. Because the plugin runs its affected code on every request, no special login or administrative session is needed to initiate the attack. Normal browsing or standard site interaction does not trigger the bug; it requires a malicious, specifically formed request.

Is my site at risk according to Halo Surface Signal?

Yes, if you use this plugin, your site is likely exposed. Halo Surface Signal identifies this as a high-risk scenario because the plugin processes requests from unauthenticated users on every page load. Since WordPress sites are typically public-facing web applications, the vulnerability is accessible to anyone on the internet by design.

What should I do if I use JSON Options?

First, inventory your WordPress environments to identify everywhere this plugin is active. Prioritize internet-facing sites, as these are the most accessible to external actors. Once identified, consult your site management process to remove the plugin or disable the affected functionality until a secure update is available to protect your site's administrative settings.

References

wpscan.com/vulnerability/6c9bbd44-cd10-40e2-af6f-440e7ccabf9a/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.