The WPAMS apartment‑management plugin contains an incorrect privilege assignment flaw that allows an attacker to increase their privileges within the plugin. An unauthorized user who can trigger the affected functionality could gain higher permissions, potentially enabling them to modify or delete apartment management data, alter user roles, or gain unauthorized administrative access. The flaw can directly compromise the confidentiality, integrity, and availability of the WordPress site.

The vulnerability affects the WordPress plugin WPAMS developed by mojoomla. All installations running versions up to and including 44.0 as of 17‑08‑2023 are impacted. No specific installation or environment details are provided beyond the plugin version.

The CVSS score of 8.8 indicates a high‑severity vulnerability. The EPSS score of less than 1% suggests that the probability of exploitation observed in the wild is currently low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an authenticated user who can access the plugin’s management interface; the attacker would exploit the improper privilege assignment to elevate their access level. Because the issue is tied to a user permission error, an attacker would need at least read or limited write ability within WordPress to exploit it.