CVE-2026-111114: Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter
The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the /?reset-view handler in roleswitchertoviewadminas() performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the profileupdate hook — does not fire when WordPress performs a bulk role change via wp-admin/users.php?action=promote, which calls WPUser::setrole() directly and leaves a stale administrator value in the nxtextviewadminoriginalrole user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the profileupdate hook that would otherwise have cleared the stored original role.
Affected Software
Event History
Frequently Asked Questions
Which accounts are realistically exposed to this privilege escalation?
An attacker must already have an authenticated account with Subscriber-level access or higher. Their account must also previously have held the Administrator role and used the View Admin Role Switcher feature before it was demoted.
What demotion workflow creates the exploitable condition?
The account must be demoted through the bulk role-change control in wp-admin/users.php using the promote action. Demotion through the Edit User screen triggers the profile_update cleanup hook and does not leave the stale Administrator role value described here.
How can administrators identify accounts that may be affected?
Review accounts that were previously administrators, used the View Admin Role Switcher feature, and were later demoted through the bulk role-change workflow. Those accounts may retain administrator as the nxtext_view_admin_original_role user-meta value despite their current lower-privileged role.
What should be done if immediate patching is not possible?
Avoid using bulk role changes to demote former administrators that have used the View Admin Role Switcher feature. Review and remediate stale nxtext_view_admin_original_role user metadata for affected accounts, and restrict or remove access for potentially affected lower-privileged accounts until remediation is complete.