The vulnerability arises from incorrect privilege assignment within the DD Roles plugin produced by Mosterd3d. Attackers can exploit this flaw to elevate their user role, thereby gaining higher authority than intended. The likely attack vector is via manipulation of role assignment features when an authenticated user submits privileged changes. The weakness lies in the improper handling of user permissions, as indicated by CWE-266.

WordPress sites that load the DD Roles plugin from Mosterd3d, specifically all releases up to and including version 4.1.

The likely attack vector is through authenticated manipulation of role assignment settings. The vulnerability scores a CVSS of 8.8, signaling high severity, but its EPSS of less than 1% suggests exploitation is unlikely at present and the issue is not yet recorded in CISA’s KEV catalog. Based on the description, it is inferred that the attacker needs at least a basic authenticated role; from there, they can manipulate role assignments or inject higher‑level permissions. No public exploit is known, but the potential impact on confidentiality, integrity, and all user accounts warrants caution.