Wp Fusion Pro
Monthly
Privilege escalation in WP Fusion (Pro) for WordPress allows authenticated attackers with Subscriber-level access to create new administrator accounts and achieve full site compromise. The vulnerability resides in the ThriveCart Auto Login handler's `thrivecart()` function, which fails to enforce authorization on the `role` parameter during user account creation, enabling callers to self-assign the `administrator` role. The required access_key is distributed openly to all ThriveCart customers as part of the plugin's documented setup, substantially lowering the practical barrier for anyone who has transacted with the target site's ThriveCart storefront; no public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in WP Fusion (Pro) for WordPress allows authenticated attackers with Subscriber-level access to create new administrator accounts and achieve full site compromise. The vulnerability resides in the ThriveCart Auto Login handler's `thrivecart()` function, which fails to enforce authorization on the `role` parameter during user account creation, enabling callers to self-assign the `administrator` role. The required access_key is distributed openly to all ThriveCart customers as part of the plugin's documented setup, substantially lowering the practical barrier for anyone who has transacted with the target site's ThriveCart storefront; no public exploit or CISA KEV listing has been identified at time of analysis.