WordPress WP User Profiles plugin versions 2.7.3 and earlier contain a vulnerable code path that allows a user with subscriber privileges to gain higher‑level access inside the WordPress site. The flaw enables an attacker to impersonate higher‑privilege accounts or perform actions reserved for administrators, thereby compromising the confidentiality, integrity, and availability of site data and functionality. This vulnerability aligns with the CWE-266 category, which covers privilege escalation flaws.

The vulnerability affects the John James Jacoby WP User Profiles plugin. Any installation of the plugin with a version equal to or older than 2.7.3 is susceptible. No other products or major WordPress components are listed as affected.

The CVSS score of 8.8 indicates a high severity impact, and although the EPSS score is low (< 1%), the lack of a KEV listing does not diminish the risk posed to sites that remain on vulnerable versions. The likely attack vector requires only a legitimate subscriber account, making the flaw exploitable on any live site that has the old plugin installed. Approximately any attacker who can authenticate as a subscriber can activate the escalation path, and the flaw carries no known mitigating conditions.