The WP Fusion (Pro) plugin allows authenticated users with Subscriber-level access and above to inject an elevated role into the ThriveCart Auto Login handler. By passing the special role parameter, an attacker can create a new administrator account, giving full control over the WordPress site. The flaw exists because the plugin does not properly check the user’s capability before accepting the role value, which is an insufficient authorization check (CWE-269). This results in a high severity privilege escalation and can lead to compromised site integrity, data theft, or defacement. The vulnerability is tied to the use of the access_key, which is shared with ThriveCart customers, so any attacker who has made a purchase and has the key can exploit the flaw.

All installations of Very Good Plugins WP Fusion (Pro) version 3.47.13 and earlier are affected. The flaw is present only when the ThriveCart Auto Login feature is enabled. Users running newer releases beyond 3.47.13 do not face this risk.

The CVSS score of 7.5 classifies this flaw as high severity. Because the EPSS score is not available, the exact likelihood of exploitation is uncertain; however, the plugin’s reliance on a shared access_key makes the condition relatively easy to meet for authenticated attackers. The vulnerability is not currently listed in the CISA KEV catalog, but the potential impact justifies proactive remediation. Attackers would need to authenticate as a Subscriber or higher and obtain the access_key, but once those conditions are met, they can create an administrator account through a simple HTTP request involving the role parameter.