The WordPress plugin Voice Feedback from bPlugins contains an incorrect privilege assignment flaw that permits an attacker to elevate privileges beyond what is intended. This flaw is categorized as CWE‑266: Improper Privilege Management and can allow a malicious user to gain elevated capabilities on the WordPress site, potentially enabling them to access restricted content or modify settings.

The vulnerability affects all installations of the Voice Feedback plugin version 1.0.3 and earlier, which are distributed via WordPress. Users running the plugin on any WordPress site are potentially exposed.

The severity of the flaw is reflected in a CVSS v3 score of 8.8, indicating high potential impact. The EPSS score of less than 1% suggests that, while exploitation is possible, the probability of widespread attacks remains low. The vulnerability is not listed in the CISA KEV catalog. The description does not specify whether remote access is required, but the flaw concerns privilege assignment, implying that an attacker with some level of authenticated access, such as an existing registered user, could leverage it to elevate privileges. Therefore, attackers could potentially take full control of the WordPress site if they exploit this flaw.