CVE-2025-11533

WP Freeio <= 1.2.21 - Unauthenticated Privilege Escalation

Published Oct 11, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.

Analysis

Technical impact

The WP Freeio plugin’s process_register() function fails to enforce role restrictions during user registration. As a result, any visitor can submit the 'administrator' role, causing the system to grant full admin privileges to an unauthenticated account. This vulnerability is a classic case of privilege escalation (CWE‑269) and would allow an attacker to modify, delete, or steal site data and install additional malicious components.

Affected Systems

The flaw exists in the ApusTheme WP Freeio plugin for WordPress in all releases up to and including version 1.2.21. Any site running one of these releases is at risk; versions newer than 1.2.21 are not known to be affected.

Risk and Exploitability

The CVSS score of 9.8 categorizes this flaw as critical. An attacker can exploit it from any network location using the public registration form, with no prior authentication required. Although the EPSS score is below 1 %, indicating a low overall exploitation probability, the ease of attack and the severity of the potential impact justify immediate attention. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog, but its high severity warrants concern.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ApusTheme

WP Freeio

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.2.21

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the WP Freeio plugin to the newest version that includes the role‑restriction fix; if unable to update, disable the plugin or migrate to a different marketplace theme.
Secure or disable the public registration page to prevent unauthenticated role assignments during sign‑ups.
Enforce role validation server‑side by restricting role options to authorized users only, ensuring that role parameters passed during registration are ignored for non‑admin users who are not logged in.

Generated by OpenCVE AI on April 27, 2026 at 23:43 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.619% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://themeforest.net/item/freeio-freelance-marketplace-wordpress-theme/42045416
https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=cve

History

Oct 20, 2025 4:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Oct 14, 2025 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 11, 2025 7:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Title		WP Freeio <= 1.2.21 - Unauthenticated Privilege Escalation
Weaknesses		CWE-269
References		https://themeforest.net/item/freeio-freelance-marketplace-wordpress-theme/42045416 https://www.wordfence.com/threat-intel/vulnerabilities/id/0db85f84-04e9-42eb-a16b-96554fbfd186?source=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`