The Simple User Capabilities plugin for WordPress is affected by a missing capability check in the suc_submit_capabilities() function. This flaw allows an attacker who has not logged in to elevate any existing user account’s role to Administrator. The vulnerability is a classic missing authorization flaw (CWE‑862), which can lead to full control of the site, content theft, and further exploitation of any other installed plugin or theme weaknesses.

WordPress sites running the tanvirahmed1984 Simple User Capabilities plugin, versions up to and including 1.0 are affected.

The CVSS score of 9.8 indicates a critical severity, but the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. An attacker can achieve privilege escalation through an unauthenticated HTTP request that triggers the vulnerable function, resulting in the ability to modify the role of any user to administrator.