The vulnerability in the Videospirecore Theme Plugin allows an authenticated user with Subscriber level or higher privileges to change the email address of any other user, including administrators. Because the plugin does not verify the identity of the requestor before allowing updates to user data, an attacker can alter another user’s email and then reset that user’s password, enabling complete takeover of the target account. This weakness corresponds to CWE‑639, which describes privilege escalation through inadequate privilege checks.

All releases of the Videospirecore Theme Plugin up to and including version 1.0.6 are affected. The plugin’s lack of proper identity verification when updating user details is the root cause.

The CVSS score of 8.8 indicates high severity, while the EPSS score of below 1 % suggests a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but it still poses a serious risk because authenticated users with subscriber level can leverage it to compromise administrators. Once the attacker has a subscriber account, the exploit path—changing another user's email, followed by resetting their password—is straightforward and can lead to full site control.