The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 4.7 because the plugin does not properly restrict which user metadata can be updated during profile registration. This flaw allows an attacker who does not possess login credentials to create a new user account that is granted full administrator privileges, effectively compromising the entire WordPress site.

WordPress sites that have the WP Foodbakery plugin installed, specifically versions 4.7 and any earlier releases.

The vulnerability scores a CVSS of 9.8, indicating critical severity, yet the EPSS score is less than 1%, meaning the current likelihood of exploitation is very low. The CVE is not listed in CISA’s KEV catalog. Attackers can trigger the flaw by simply accessing the registration endpoint without authentication, submitting malicious role data, and having the plugin accept the request. While the score is high, the low exploitation probability and lack of a publicly known exploit reduce immediate risk, but the potential impact remains catastrophic if an attacker succeeds.