The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress contains a flaw that lets an authenticated user alter any user meta data via the update_user_meta() function. This flaw enables a malicious account with basic Subscriber or higher privileges to elevate its role to Administrator, effectively granting full control over the WordPress site. The impact is that attackers could gain complete administrative access, read or modify site content, install additional plugins, or compromise the integrity and confidentiality of site data.

The vulnerability affects the CubeWP Framework plugin for WordPress, versions up to and including 1.1.23. Users running any of these versions should verify the installed version and consider an upgrade.

The flaw is a high‑severity issue with a CVSS score of 8.8. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed public exploitation. However, the attack requires an authenticated user with Subscriber or higher access and the ability to send a request to the plugin’s REST API endpoint that calls update_user_meta. The attack vector is inferred to be a REST API call, as the description indicates the flaw occurs in the plugin’s API handling code.