The Eazy Plugin Manager plugin for WordPress allows an authenticated user with Subscriber-level or higher access to perform a privilege escalation. The issue is caused by insufficient authorization on the wp_ajax_pos_get_option AJAX handler, which only validates a nonce but does not verify user capabilities before returning any WordPress option via get_option(). This can expose the option values site_url, connection_key, and remote_user_id stored in eazywp_connecting_info and eazywp_connection. An attacker can read these values, compute an auth_key, and then invoke the public REST endpoint GET /wp-json/epm/v1/admin/login. Because that endpoint authenticates solely by a whirlpool hash derived from the same options, the attacker can obtain Administrator authentication cookies and fully take over the site. The vulnerability requires that the plugin’s remote connection feature has been configured and the relevant options are populated.

All installations of the Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress up to and including version 4.4.1 are affected. Versions newer than 4.4.1 are not affected.

The reported CVSS score of 8.8 classifies the flaw as High severity. The EPSS score of less than 1% indicates that, at the time of analysis, the probability of exploitation in the wild is low, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated as a Subscriber or higher, the plugin’s remote connection feature to be enabled and correctly configured, and no additional network or application barriers. Once those prerequisites are met, the attacker can easily read the protected options, calculate the authentication key, and elevate privileges to an Administrator through the publicly reachable REST endpoint. The attacker therefore gains full control over the site, impacting confidentiality, integrity, and availability.