The Starfish Review Generation & Marketing for WordPress plugin contains a missing capability check in the srm_restore_options_defaults function. This flaw allows authenticated users with Subscriber level or higher to execute an AJAX callback that updates plugin options globally. Because the options can control user registration settings and the default role assigned to new users, an attacker can modify the site to permit registration and set the role of newly registered users to Administrator, thereby escalating privileges.

WordPress sites running the Starfish Review Generation & Marketing for WordPress plugin version 3.1.19 or earlier are affected. All installations that have not upgraded past this version remain vulnerable.

The vulnerability carries a CVSS score of 8.8 and an EPSS score of less than 1%, indicating a low probability of exploitation at the time of analysis. It is not listed in the CISA KEV catalog. Exploitation requires authentication as a Subscriber or higher and relies on the AJAX endpoint srm_restore_options_defaults; therefore the attack vector is local, authenticated, and requires a valid user account. Successful exploitation can lead to complete compromise of the WordPress site by creating or using an Administrator account.