The Social Streams plugin for WordPress fails to validate a user's identity when calling update_user_meta, permitting an authenticated user with Subscriber-level access or higher to modify the role meta for their own account. This unauthorized change elevates the account to Administrator, giving full control over the site. The flaw is a classic privilege escalation vulnerability. No additional interaction beyond a valid login is required.

This flaw exists in the steverio Social Streams WordPress plugin for all releases up to and including version 1.0.1 as indicated by the official description. Sites that have installed the plugin and allow any authenticated user with Subscriber or higher roles are at risk. The title suggests a broader range of <= 1.2.1, but the CVE text confirms up to 1.0.1.

The CVSS score of 8.8 classifies the issue as high severity, while the EPSS score of less than 1 % indicates that widespread exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV database, meaning no publicly known exploits are documented. An attacker would need a legitimate WordPress account with at least Subscriber privileges, which can be achieved via local login or credential compromise, and can then trigger the flawed update_user_meta call through the plugin’s front‑end API or otherwise. Once executed, the user’s role is changed to Administrator, enabling full administrative takeover.