WP Freeio CVE-2025-11533
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running WP Freeio
-
DeliverySubmit registration request with 'administrator' role
-
Exploitprocess_register() creates admin account
-
ExecutionLog in as administrator
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the target WordPress site has the WP Freeio plugin (version ≤1.2.21) installed and active, and that its public user-registration flow calling process_register() is reachable - which is the plugin's core purpose as a freelance-marketplace registration system, so it is effectively the default operating state rather than a special configuration. The attacker must craft a registration request that includes a role parameter set to 'administrator'; no authentication, user interaction, or special privileges are needed. The only meaningful limiting factor is the presence of this specific plugin, which narrows the exploitable population to sites running WP Freeio. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with full C/I/A impact, and the mechanism - an unauthenticated user picking the 'administrator' role at registration - is a trivially reliable, one-request takeover rather than a memory-corruption bug needing refinement, so the 9.8 is well-justified by the described behavior. The signals do diverge: EPSS is only 0.62% (48th percentile), the CVE is NOT on CISA KEV, and no public exploit is referenced. The low EPSS despite a critical, easy-to-exploit bug most likely reflects the plugin's limited deployment footprint and the recency of disclosure rather than any difficulty of exploitation - EPSS is a population-level probability, not a measure of how hard this specific bug is. Bottom line: easy and devastating where the plugin is installed, but the affected population is small, so prioritize patching on any site running WP Freeio while treating mass-internet exploitation as currently unproven. |
| Exploit ScenarioDerived | An unauthenticated attacker locates a WordPress site running the WP Freeio plugin (freelance-marketplace theme) and submits the plugin's public registration request, injecting 'administrator' as the chosen user role. The process_register() function fails to validate the role, so the attacker's new account is created with full administrator privileges, granting complete control of the site. No public exploit is identified at time of analysis, but the technique is simple enough to reproduce from the vulnerability description alone. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthenticated privilege escalation in the WP Freeio plugin for WordPress (all versions up to and including 1.2.21) allows remote attackers to register a new account with the 'administrator' role, granting full control of the affected site. The plugin's process_register() function fails to restrict which roles a self-registering user may request, so supplying a role parameter of 'administrator' during the normal public registration flow is sufficient - the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), requiring no authentication or user interaction. WP Freeio is a commercial ThemeForest item used as a freelance-marketplace theme, and because the vulnerable registration flow is the plugin's core function it is exposed by default rather than under a special configuration; EPSS is low (0.62%, ~48th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis, but the trivial exploitation path makes this a genuine high-priority issue rather than a CVSS-inflated one.
RemediationAI
No vendor-released patch identified at time of analysis, so the safest immediate action is to deactivate and remove WP Freeio 1.2.21 and earlier from any production site until the vendor ships a fixed build; the trade-off is loss of the marketplace functionality the theme provides. If the site must remain online, temporarily disable public user registration or block registrations that pass a 'role' parameter (and specifically any role=administrator or role=editor value) at the web-application firewall or reverse-proxy layer - note that this will break legitimate onboarding for the marketplace, which is why it is a stopgap rather than a fix. Concurrently, audit the wp_users / wp_usermeta tables for accounts created with administrator capabilities that were not provisioned by an administrator, remove or demote any such accounts, rotate credentials and salts for the site, and review registration and admin activity logs for evidence of unauthorized account creation. Monitor the plugin's ThemeForest listing and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=cve, referenced alongside the ThemeForest item page) for a patched version, and apply it as soon as it is published. The supplied data does not confirm a fixed release, so no specific patched version number can be cited.
Affected ProductsAI
WP Freeio, the WordPress freelance-marketplace plugin/theme obtained through ThemeForest as 'Freeio - Freelance Marketplace WordPress Theme' (item 42045416, https://themeforest.net/item/freeio-freelance-marketplace-wordpress-theme/42045416), in all versions up to and including 1.2.21. Any WordPress site running WP Freeio at or below 1.2.21 with its public registration flow reachable - the plugin's default state - is exposed. No CPE entries were provided in the available data; the authoritative tracking advisory is Wordfence's threat-intel record at https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=cve, which is the vendor-adjacent source for this disclosure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an instance of CWE-269 (Improper Privilege Management) rooted in the WP Freeio plugin's process_register() routine, which handles user sign-up for the marketplace. WordPress assigns capabilities through role assignments stored against the user record, and the standard WP_User / wp_insert_user() APIs will honor a 'role' value supplied by the caller. Because process_register() takes the requested role from attacker-controlled registration input and applies it without validating that it matches the intended low-privilege default (e.g., subscriber or the plugin's own custom marketplace role), a crafted registration request can set that value to 'administrator'. The CVSS vector confirms the attack is network-reachable with no privileges (PR:N) and no user interaction (UI:N); exploitation therefore reduces to a single unauthenticated HTTP request to the plugin's public registration endpoint. No CPE strings were supplied in the intelligence feed, but the affected component is the WordPress plugin 'wp-freeio' distributed commercially as the Freeio - Freelance Marketplace WordPress Theme, and the vulnerable path is reachable whenever that plugin/theme's registration flow is active, which is its normal operating state.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated attacker reaches a public registration endpoint over the network (AV:N/PR:N/UI:N) and a single request yields administrator access, so AC:L with full C/I/A.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
DescriptionCVE.org
The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Executive ViewAI
WP Freeio plugin for WordPress contains a critical unauthenticated privilege-escalation flaw (CVE-2025-11533) that lets any remote attacker create an administrator account and take full control of an affected site. Organizations running this commercial ThemeForest freelance-marketplace theme on versions up to and including 1.2.21 are exposed by default, putting site content, user accounts, customer data, and marketplace operations at risk. Leadership should treat this as a severe business continuity and data protection issue until the plugin is disabled, replaced, or formally remediated.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the WP Freeio plugin; disable public user registration; block role parameters at the WAF/reverse proxy; restrict registration to invite-only or administrator-approved accounts; audit administrator accounts and logs for unauthorized creation; enforce least privilege and monitor for new administrator users. Replace the plugin with a maintained alternative or apply a vendor patch only after one is released and validated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
GitHub PoC
Exploit-DB