The vulnerability in the Vehica Core plugin allows an authenticated user with Subscriber-level access to alter user meta fields that are not properly validated before database updates. This flaw enables such a user to elevate their privileges to Administrator, gaining full control over the WordPress site. The weakness is classified as CWE-269, an improper privilege escalation flaw.

TangibleWP’s Vehica Core plugin, versions up to and including 1.0.97, is affected. The plugin is used in conjunction with the Vehica – Car Dealer & Listing WordPress Theme, and any site deploying these components under the identified versions is at risk.

The CVSS score of 8.8 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests a low likelihood of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. Attacks would require an authenticated user already possessing Subscriber privileges or higher, after which the improper validation of user meta fields would be exploited to gain Administrator rights.