Technical impact
The vulnerability in e‑plugins Final User plugin involves incorrect privilege assignment that can allow an attacker with limited WordPress permissions to gain administrator level rights. This escalation can lead to full control over site content, configuration, and the ability to exploit other plugins or themes. The flaw is an instance of improper authorization (CWE‑266).
Affected Systems
The issue impacts e‑plugins Final User WordPress plugin versions through 1.2.5. Any WordPress installation using Final User 1.2.5 or older is potentially vulnerable. No other vendors or products are listed.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity. The EPSS score of <1% shows a low probability of automated exploitation being observed. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote exploitation via the plugin’s administrative screens, inferred from the plugin’s web‑based nature. Attackers could exploit the flaw if they already have a basic user account or can reach the site’s web interface, allowing them to broaden their role to Administrator and compromise confidentiality, integrity, and availability.
