The vulnerability is a Cross‑Site Request Forgery that arises from missing or incorrect nonce validation in the whitelist_options() function. An unauthenticated attacker can forge a request that changes the default role option, which could enable privilege escalation if a site administrator submits the request. This mechanism is a typical example of CWE‑352. The impact is that attackers could gain administrative rights on the site if the exploit succeeds.

The affected product is the WPFront User Role Editor plugin for WordPress, authored by syammohanm. All versions up to and including 4.2.1 are vulnerable. The issue applies only to WordPress multisite installations.

The CVSS score of 8.8 indicates high impact, while the EPSS score of less than 1% suggests exploitation probability is currently low but not zero. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to convince a site administrator to click a crafted link; once the forged request is submitted to a multisite instance, default role options can be altered, allowing an attacker to assume higher privileges.