In the OttoKit plugin for WordPress, an incorrect privilege assignment flaw allows attackers to elevate their permissions within a site. The vulnerability arises from improperly handling the plugin’s suretriggers feature, enabling users to obtain higher authority than intended. This is a classic privilege escalation issue as defined by CWE‑266, and is assigned a CVSS score of 9.8.

All WordPress sites that have installed the OttoKit plugin at version 1.1.40 or earlier are affected. Any installation that has not upgraded beyond 1.1.40 remains vulnerable.

The high CVSS score indicates significant potential impact. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but the absence of these metrics does not diminish the risk for sites still using older releases. Based on the description, it is inferred that the attack vector could involve network interaction with the WordPress front‑end or an authenticated user engaging with OttoKit’s suretriggers, which would trigger the privilege escalation. The exact preconditions are not specified, yet the available information suggests that any user with some level of access to the plugin could exploit the flaw.