CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Explanation of Vulnerability in Simple Terms
WP Freeio versions up to 1.2.21 contain a privilege management flaw that allows unauthenticated attackers to gain full control of the site. The vulnerability requires no user interaction and can be exploited over the network. An attacker can read sensitive data, modify site content, and disrupt service.
What an attacker can do
Gain full administrative control of the site without authentication.
Potential impact on your site
Complete site compromise: attackers can steal data, modify content, create accounts, and take the site offline.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
