The vulnerability in WordPress Hybrid Composer 1.4.6 permits an attacker without authentication to alter site options by sending a POST request to the admin-ajax.php endpoint with the action parameter hc_ajax_save_option. This flaw allows the attacker to enable user registration and set the default role to administrator, effectively creating a new admin account and enabling full site takeover. The weakness corresponds to CWE-306, which involves missing authentication checks during privileged operations.

Any WordPress installation that uses the Hybrid Composer plugin version 1.4.6 from framework‑y is affected. No other versions are listed as vulnerable, and the vulnerability is tied specifically to this plugin’s action handler.

With a CVSS score of 9.3 the flaw is rated high severity and can be exploited without any prior compromise. The lack of an EPSS score does not diminish the likelihood of exploitation when the plugin is present, and the flaw is not listed in the CISA KEV catalog. Attackers can simply craft a malicious HTTP POST request to admin‑ajax.php; no authentication or privileged access is required. If a site permits user registration, the attacker can create an administrative user and gain full control of the WordPress instance.