The Email Notifications for Updates plugin for WordPress contains a missing capability check in the awun_import_settings() function. The flaw allows authenticated users with Subscriber-level access or higher to update arbitrary WordPress options. By changing the default role for new registrations to administrator and enabling user registration, an attacker can create a new administrative account. This bypasses normal access controls and can lead to full site compromise.

All installations of WordPress that use the Email Notifications for Updates plugin version 1.1.6 or earlier are affected. The vulnerability applies to any user with a Subscriber role or higher, as the missing check is in the plugin code for all affected releases.

The CVSS score of 8.8 reflects a high severity issue. The EPSS score of less than 1% indicates current exploitation is rare, and the flaw is not listed in CISA's KEV catalog. However, because the vulnerability only requires an authenticated Subscriber account, many sites may have users that meet this requirement. Exploitation would involve an attacker logging in as a subscriber, invoking the awun_import_settings() endpoint with crafted option values (e.g., default_role=administrator, user_registration=1), and thereby creating an administrative user. The root weakness is a missing authorization check (CWE‑862).