The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation because the plugin does not correctly validate user meta fields before updating them in the database. This flaw is a classic case of CWE-269, where an attacker is able to write data they should not be permitted to write, elevating their permissions. As a result, an authenticated user with the minimum Subscriber role or higher can modify stored user meta to acquire Administrator‑level access, undermining the integrity of the site’s access controls.

WordPress sites that have the wp-configurator:Configurator Theme Core plugin installed with any version up to and including 1.4.7. The vulnerability affects all users who have Subscriber‑level access or higher, regardless of the site’s specific configuration or role definitions.

The CVSS score of 8.8 indicates a high severity assessment. The EPSS score of less than 1% suggests that, as of the latest data, exploitation is not currently common, but the vulnerability remains a significant risk because it requires only an existing authenticated account and no special network access. The vulnerability is not listed in CISA’s KEV catalog, so it has not been observed in widespread exploitation campaigns. The likely attack vector is an authenticated, subscriber‑level user who can trigger the plugin’s user metadata update mechanisms, allowing them to inject elevated authority credentials directly into the database.