The WP Freeio plugin’s process_register() function fails to enforce role restrictions during user registration. As a result, any visitor can submit the 'administrator' role, causing the system to grant full admin privileges to an unauthenticated account. This vulnerability is a classic case of privilege escalation (CWE‑269) and would allow an attacker to modify, delete, or steal site data and install additional malicious components.

The flaw exists in the ApusTheme WP Freeio plugin for WordPress in all releases up to and including version 1.2.21. Any site running one of these releases is at risk; versions newer than 1.2.21 are not known to be affected.

The CVSS score of 9.8 categorizes this flaw as critical. An attacker can exploit it from any network location using the public registration form, with no prior authentication required. Although the EPSS score is below 1 %, indicating a low overall exploitation probability, the ease of attack and the severity of the potential impact justify immediate attention. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog, but its high severity warrants concern.