The flaw is compounded by an inadequate cleanup mechanism in the profile_update hook. When a user is demoted from Administrator using the bulk role-change control in wp-admin/users.php, the plugin fails to clear the nxtext_view_admin_original_role user meta. Because this bypasses the standard profile_update hook, the stale administrator role persists in the user profile. Authenticated users who were previously administrators and demoted via this specific bulk path can trigger the /?reset-view handler to restore their administrator privileges, granting them unauthorized full access to the WordPress environment.

Impact

Successful exploitation allows a user with Subscriber-level access or higher to escalate their privileges to Administrator. This impact is contingent on the attacker having previously held Administrator status and having been demoted specifically via the WordPress bulk user management interface. This vulnerability affects any WordPress site utilizing the Nexter Extension plugin (<= 4.7.11).

Recommendation

• Update the Nexter Extension plugin to a version addressing CVE-2026-111114 immediately.
• Audit the wp_usermeta table for suspicious entries in the nxtext_view_admin_original_role column, particularly for users who should not currently possess administrative privileges.
• Restrict administrative access to the WordPress bulk user management interface to trusted personnel until the plugin is patched.