CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Explanation of Vulnerability in Simple Terms
WP CarDealer versions up to 1.2.16 contain a privilege management flaw that allows unauthenticated attackers to gain full control of the site over the network. The vulnerability requires no user interaction and affects confidentiality, integrity, and availability. Site administrators should update immediately to a version newer than 1.2.16.
What an attacker can do
Read, modify, or delete any site data; create admin accounts; run code on the server.
Potential impact on your site
Complete compromise of the WordPress site without any warning or user action needed.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
