The Administrator Z plugin for WordPress contains a missing capability check that allows any authenticated user with Subscriber-level access or higher to call the adminz_import_backup() function. This flaw permits the attacker to modify arbitrary WordPress options, including changing the default role for new registrations to Administrator and enabling user registration. By doing so, an attacker can create administrator accounts and gain full control over the site, escalating privileges without needing to exploit any additional weaknesses. The underlying issue is a missing authorization check (CWE‑862).

All versions of the quyle91 Administrator Z plugin up to and including 2025.03.24 are affected. The vulnerability can be exploited on any WordPress site that has the plugin installed and a subscriber or higher role is available. No specific platform versions are listed, so any standard WordPress installation running the vulnerable plugin versions is at risk.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of <1 % suggests that widespread exploitation is currently unlikely, although the vulnerability is not listed in the CISA KEV catalog. The attacker must first authenticate with a legitimate subscriber or higher account, then invoke the unprotected function; once exploited, the attacker can change site settings to elevate privileges. Because the flaw is purely an authorization deficiency, the overall risk is high for anyone who can log into the site, but the exploitation probability is low at present.