This vulnerability exposes the Ak Framework plugin for WordPress, bundled with the Newsy theme, to a privilege escalation flaw caused by missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers. The plugin accepts attacker‑controlled option names and values and forwards them to the update_option() call without verifying that the caller has sufficient rights. An attacker who can trigger these handlers can alter critical WordPress options such as users_can_register and default_role, thereby enabling the creation of new administrator accounts or elevating existing users to administrator status.

All installations of Ak Framework version 2.9.8 or earlier, which are typically found in WordPress sites running the Newsy - Viral News & Magazine theme, are affected. The vendor responsible is Ak Bilisim, operating the Ak Framework product.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability, and the security analysis indicates no capability checks are performed, meaning both unauthenticated and low‑privileged users may invoke the vulnerable AJAX endpoints. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that while the potential impact is severe, the current exploitation probability is uncertain. Nevertheless, the apparent ease of the attack path—sending a crafted AJAX request with arbitrary option data—underscores the need for prompt remediation.