WordPress EUVD-2025-16984

This vulnerability presents extreme real-world risk across multiple dimensions: (1) CVSS 9.8 with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network-accessible, low-complexity exploitation requiring no privileges or user interaction, with high impact across confidentiality, integrity, and availability; (2) the missing capability check is a fundamental authorization flaw (CWE-862) with trivial exploitability once discovered; (3) the attack chain is fully automatable—an attacker can programmatically discover WordPress sites using the plugin, trigger the vulnerable AJAX handler, and escalate to admin access without user interaction; (4) the privilege escalation vector is particularly severe because it chains directly to account creation and admin role assignment, providing immediate complete system compromise. While EPSS data and KEV candidacy status are not provided in references, the combination of unauthenticated access + network vector + direct privilege escalation + trivial exploitation + high attack automation potential makes this a critical priority regardless of theoretical exploitation metrics. This is not a 'high-CVSS-but-low-risk' scenario; the risk is both high-scoring AND operationally severe.

A threat actor discovers a WordPress site running the HyperComments plugin (via public version fingerprinting or WordPress.org plugin enumeration). The attacker sends an unauthenticated HTTP POST request to /wp-admin/admin-ajax.php with parameters action=hc_request_handler and crafted option modification data (e.g., option_name=default_role&option_value=administrator and option_name=users_can_register&option_value=1). Due to the missing capability check, the hc_request_handler function processes this request without verifying user authentication or permissions. The attacker then registers a new WordPress user account, which is automatically assigned the administrator role due to the modified default registration role. The attacker logs in with their new admin account and gains full control of the WordPress installation, including access to sensitive data, ability to modify site content, install malicious plugins, and potentially compromise the underlying web server. This entire attack sequence requires zero user interaction, can be completed in seconds, and is easily automatable for scanning and exploiting multiple vulnerable sites at scale.