CVE-2026-12144

CVE-2026-12144 exposes a WordPress plugin where a nonce served as the sole gatekeeper for a privileged operation — role promotion via a meta box — despite being rendered on an admin page accessible to users with author-level privileges. The vulnerability isn't a simple missing capability check; it's a cascading assumption failure that reveals how developers conflate CSRF protection with authorization. The core issue: the plugin registered a custom post type (`wwp_requests`) using `capability_type => 'post'`, which grants authors full edit access to their own requests. A meta box on the edit screen contained a nonce meant to protect the `save_requests_meta()` function from CSRF. But that function performed privileged operations — promoting users to administrator — with no capability check like `current_user_can('promote_users')` or `current_user_can('manage_options')`. The nonce was the only guard, and since it was rendered on a page authors could reach, the nonce effectively became a de facto authorization token. Three design failures compound this. First, zero capability checks on the callback — the developer assumed the nonce's admin-only visibility implied authorization. Second, `sanitize_text_field()` was applied without an allowlist, providing sanitization theater rather than real protection. Third, and critically, a wholesale registration form automatically created the posts that authors could access, bridging the privilege gap. You don't need stolen credentials to exploit this; the registration form essentially hands you the attack surface. For defenders: audit your plugins for nonces rendered on admin pages accessible to non-administrators. For any function gated by a nonce, add explicit capability checks regardless of where the nonce appears. If using custom post types, avoid `capability_type => 'post'` when the post type supports privileged operations — define custom capabilities instead. Treat nonce visibility as a UI concern, not an authorization decision.

Reviewed through automated stages and approved by a human before publication.