EUVD-2026-93084
GHSA-7qfw-cm5p-qpvw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/authenticate as subscriber
-
DeliverySubmit crafted profile/role request
-
ExploitTrigger improper privilege assignment
-
ExecutionGain elevated (admin) privileges
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Requires a valid low-privilege (subscriber) account on a WordPress site running the WP User Profiles plugin version 2.7.3 or earlier; on sites that allow open user registration this prerequisite is trivially met by any visitor. The attack is remote and needs no user interaction (UI:N) and no non-default configuration beyond having the vulnerable plugin active. Limiting factors: exploitation is impossible without an authenticated subscriber session (PR:L), so sites that disable public registration and tightly control account creation substantially raise the bar; the flaw also only affects installations running the affected plugin, which is not broadly deployed. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-privilege, network-exploitable privilege-escalation flaw (CWE-266, Incorrect Privilege Assignment) in which an authenticated subscriber-level user can elevate to higher privileges with full confidentiality, integrity and availability impact. This is a genuinely dangerous class of bug for multi-user WordPress sites because subscriber accounts are often self-registered, making PR:L a very low bar. However, several real-world risk signals are MISSING from the input: no EPSS score, no CISA KEV listing, and no POC indicator are provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The single source is Patchstack (the vulnerability's reporter), with no independent vendor advisory or NVD enrichment supplied. Net assessment: high technical severity and low exploitation barrier, but priority should be tempered by the absence of exploitation-probability data and the plugin's limited deployment footprint - treat as a prompt-patch item for sites running this specific plugin with open registration, not a mass-exploitation emergency. No conflict exists between the CVSS vector and the description; both consistently indicate authenticated remote abuse. |
| Exploit ScenarioDerived | An attacker self-registers (or uses an existing subscriber account) on a WordPress site running WP User Profiles <= 2.7.3, then sends a crafted authenticated request that abuses the plugin's improper privilege assignment to grant themselves elevated capabilities such as administrator-level access. No user interaction or victim involvement is required. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Privilege escalation in the WordPress plugin WP User Profiles (versions 2.7.3 and earlier) allows an authenticated subscriber-level user to elevate to higher privileges, achieving full confidentiality, integrity and availability impact on the affected site. The flaw is network-exploitable with no user interaction and requires only a valid low-privilege account, which is trivially obtainable on any site that permits open user registration; sites that restrict account creation substantially raise the bar. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the 8.8 base score and the low prerequisite make prompt patching or plugin removal the priority.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-user-profiles/vulnerability/wordpress-wp-user-profiles-plugin-2-7-3-privilege-escalation-vulnerability) for the confirmed fixed release and upgrade WP User Profiles to that version or later as soon as it is published; if no fixed release is available, deactivate and remove the plugin entirely, accepting the loss of its profile-management functionality as the trade-off. Because the attack requires an authenticated subscriber account, a strong compensating control is to disable open registration (WordPress Settings > General > Membership) and audit existing subscriber accounts, though this does not help sites that legitimately need public sign-ups. Additional hardening: restrict account creation to vetted users, review and prune unused low-privilege accounts, immediately audit user roles and capabilities for unexpected administrator grants (any subscriber that has gained elevated capabilities indicates prior exploitation), enforce least privilege on custom roles, and deploy a WAF rule set that blocks low-privilege users from POSTing role or capability fields to profile-update endpoints - noting that generic WAF signatures may miss this specific parameter set and that no mitigation substitutes for the vendor fix. Rotate administrative credentials and secret salts if compromise is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an incorrect privilege assignment (CWE-266) in a WordPress plugin that manages user profile data. WP User Profiles extends WordPress's native user-management screens, so it routinely reads and writes role and capability metadata (wp_capabilities, user meta and profile fields) on behalf of the acting user. Because the plugin fails to enforce adequate capability checks and role-level authorization on that update path, an account holding only the subscriber role can supply values that are persisted as higher-privilege role or capability data - classic vertical privilege escalation, in which the application assigns a privilege level the actor is not entitled to. The affected component is identified by CPE cpe:2.3:a:john_james_jacoby:wp_user_profiles (vendor john_james_jacoby) and tracked in the EU inventory as EUVD-2026-93084, reported through Patchstack. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms remote reachability (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), but an authenticated low-privilege session (PR:L) is a hard precondition - exploitation is impossible without one. Impact scope is Unchanged (S:U), meaning the compromise stays within the WordPress site's security authority (the web application and its database), though that authority typically extends to full site control.
Know when Wp User Profiles gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated subscriber (PR:L) can remotely escalate privileges with no interaction (AV:N/AC:L/UI:N); resulting admin-level control yields full C/I/A impact within the same security scope (S:U).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
Executive ViewAI
A high-severity privilege escalation flaw in the WordPress plugin WP User Profiles (versions 2.7.3 and earlier) lets a low-privilege account holder on a WordPress site seize administrative control, with full loss of confidentiality, integrity and availability for the affected site. Because the plugin has no vendor-released patch, every site running it - particularly those permitting open user registration - remains exposed until the plugin is removed or mitigated. Leadership should treat this as a live governance and brand risk: compromised sites can be defaced, used to host malicious content, or leveraged as a foothold into the wider hosting environment.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate WP User Profiles (versions 2.7.3 and earlier) entirely; disable open user registration and restrict account creation to trusted, verified users; audit and continuously monitor user-role assignments for unauthorized elevation; apply WAF or reverse-proxy rules blocking profile-escalation requests against the plugin; enforce least privilege and multi-factor authentication for all WordPress accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB