Expire Users EUVD-2026-14159

Requires WordPress with Expire Users plugin versions up to 1.2.2 enabled. Attacker must be an authenticated user with Subscriber-level access or higher. No victim interaction needed. Attacker directly modifies 'on_expire_default_to_role' meta via 'save_extra_user_profile_fields' function to elevate privileges to administrator.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates this is a network-exploitable vulnerability with low attack complexity requiring only low-level privileges (authenticated subscriber account) and no user interaction, resulting in complete compromise of confidentiality, integrity, and availability. The attack surface is broad since any WordPress site using the vulnerable plugin with user registration enabled is at risk. While the 8.8 CVSS score accurately reflects the technical severity, the real-world risk depends on whether the Expire Users plugin is widely deployed. The low attack complexity and low privilege requirement make this highly automatable and easily exploitable once an attacker obtains any authenticated account (even subscriber level). No EPSS score or KEV listing is currently available, suggesting limited observed exploitation in the wild, but the straightforward exploitation path and publicly available technical details at the WordPress plugin repository make this a genuine priority for organizations using this plugin.

An attacker first registers a free subscriber account on a WordPress site running the vulnerable Expire Users plugin or compromises an existing low-privilege account through credential stuffing or phishing. The attacker then crafts a malicious request to the 'save_extra_user_profile_fields' function, modifying their own 'on_expire_default_to_role' meta field to designate 'administrator' as their target role. Upon successful exploitation, the attacker gains full administrator access to the WordPress installation, enabling them to install malicious plugins, steal sensitive data, deface the website, create backdoor accounts, or pivot to attack the underlying server infrastructure.