The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress allows an authenticated attacker with Subscriber or higher access to elevate privileges to Administrator. The vulnerability stems from the /?reset-view handler in the role_switcher_to_view_admin_as() function, which performs no nonce or capability verification when the supplied username matches the authenticated caller. Additionally, the plugin removes the original role value only during individual profile updates and not during bulk role changes invoked through wp-admin/users.php?action=promote. This oversight leaves a stale administrator value stored in the nxtext_view_admin_original_role meta field. An attacker who previously held the Administrator role can have that role stripped via a bulk role‑change action and later trigger reset‑view to restore the original Administrator role, thereby regaining full site control.

All WordPress sites that have installed the posimyththemes Nexter Extension plugin through version 4.7.11, inclusive. Any site where the plugin is active and an account has a history of holding an Administrator role that was later removed via the bulk role‑change feature is vulnerable.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score is below 1%, suggesting a very low but non‑zero chance of exploitation in the wild. The issue is not listed in the CISA KEV catalog. The attack requires an authenticated user who has once had Administrator privileges, then had that role demoted through a bulk process, and later performs the reset‑view action. The attack vector is internal, as the attacker must first log in and meet the pre‑conditions outlined by the plugin’s logic. Due to the severity and the requirement for an existing user account, organizations should treat this as a high‑priority issue and monitor for unauthorized role changes.