Wp User Profiles
Monthly
Privilege escalation in the WordPress plugin WP User Profiles (versions 2.7.3 and earlier) allows an authenticated subscriber-level user to elevate to higher privileges, achieving full confidentiality, integrity and availability impact on the affected site. The flaw is network-exploitable with no user interaction and requires only a valid low-privilege account, which is trivially obtainable on any site that permits open user registration; sites that restrict account creation substantially raise the bar. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the 8.8 base score and the low prerequisite make prompt patching or plugin removal the priority.
Privilege escalation in the WordPress plugin WP User Profiles (versions 2.7.3 and earlier) allows an authenticated subscriber-level user to elevate to higher privileges, achieving full confidentiality, integrity and availability impact on the affected site. The flaw is network-exploitable with no user interaction and requires only a valid low-privilege account, which is trivially obtainable on any site that permits open user registration; sites that restrict account creation substantially raise the bar. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the 8.8 base score and the low prerequisite make prompt patching or plugin removal the priority.