The vulnerability is an Incorrect Privilege Assignment flaw that allows an attacker to elevate their privileges through the Melapress Role Editor WordPress plugin. By exploiting the flaw, an attacker can assign themselves a higher role or grant elevated rights to other users, potentially gaining full administrative control over the WordPress site. This elevates the risk of data tampering, unauthorized access, or sabotage of site functions, and the weakness is categorized as a role‑based access control breach (CWE‑266).

Melapress Role Editor plugin for WordPress, version 1.3.0 and earlier. The vulnerability applies across all revisions from the earliest release up to and including 1.3.0, with no identified fixed versions prior to that release.

The CVSS score of 9.6 places this flaw in the "Critical" range, underscoring its severe impact. The associated EPSS score is not available, leaving the exploitation probability uncertain, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is via the plugin’s role editing interface or API calls, allowing a user with sufficient access to the site to trigger the privilege escalation. The absence of an EPSS value means defenders lack a precise likelihood metric, but the high CVSS and lack of mitigations recommend treating this as an urgency‑high risk scenario.