The HyperComments plugin for WordPress contains a missing capability check on the hc_request_handler function, allowing unauthenticated users to modify any WordPress option. An attacker can use this to change the default role for new registrations to administrator, enable user registration, and thereby create an administrative account with full access to the site. This flaw leads directly to privileged control over the affected WordPress installation.

All WordPress sites that have the HyperComments plugin version 1.2.2 or earlier installed are impacted. The vulnerability exists in the siteheart:HyperComments plugin as distributed to users through the WordPress plugin repository.

The CVSS score of 8.8 indicates a high severity weakness, and the EPSS score of 13% suggests a moderate likelihood of exploitation. The vulnerability was not listed in CISA KEV. Based on the description, it is inferred that the attacker can exploit the flaw remotely by sending crafted HTTP requests to the plugin’s request handler, without any authentication. Once successful, the attacker can perform privilege escalation and take full administrative control of the site.