The Postem Ipsum plugin contains a missing capability check in the postem_ipsum_generate_users() function, allowing an authenticated user with Subscriber-level access or higher to create new user accounts with administrator privileges. This flaw enables attackers to elevate their privileges and compromise the integrity of the WordPress site, without affecting availability or confidentiality directly. The vulnerability is a classic privilege escalation via inadequate authorization control (CWE‑862).

Vendor: franciscopalacios; Product: Postem Ipsum. Versions 3.0.1 and all earlier releases are vulnerable. No further sub‑versions or product variations are listed, so all builds up to and including 3.0.1 should be considered affected.

The CVSS score of 8.8 classifies the issue as critical severity, yet the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The lack of a KEV listing further suggests limited current exploitation activity. An attacker would need to be authenticated as a Subscriber or higher role and possess access to the WordPress dashboard or API to trigger the vulnerable function, so the attack vector is local to a logged‑in user. Given the high impact and sufficient authentication prerequisites, the risk to affected installations is moderate to high, especially on sites that grant Subscriber access. The risk is mitigated by disabling the vulnerable function or applying the vendor’s fix.