The Toret Manager plugin for WordPress lacks a capability check in the trman_save_option and trman_save_option_items functions. This omission allows an authenticated user with Subscriber-level permissions or higher to modify any of the plugin’s options. An attacker could alter critical settings such as the default registration role or enable user registration, thereby creating new administrator accounts or otherwise elevating privileges on a compromised site.

WordPress sites running the Toret Manager plugin version 1.2.7 or earlier are affected. The vulnerability applies to all product releases up to and including 1.2.7 as listed by the CNA.

The flaw carries a high severity score of 8.8 and a very low likelihood of exploitation, with estimates below 1 percent. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated session; attackers can send AJAX requests to the vulnerable endpoints to change options. Successful exploitation could immediately grant administrator privileges or facilitate further compromise of the WordPress installation.