A flaw in the Directorist Social Login plugin for WordPress permits an attacker to incorrectly assign privileges, allowing them to elevate their permissions beyond the intended scope. The vulnerability is rooted in improper privilege management and could be exploited to gain administrative rights on the affected site. The weakness is classified as CWE-266.

The Directorist Social Login plugin for WordPress, versions older than 2.1.4, is affected. Any WordPress installation that has a pre‑2.1.4 version of the plugin enabled is at risk.

The CVSS score is 9.8, indicating a critical severity. The EPSS score is less than 1 %, suggesting a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the web interface of a WordPress site that has the vulnerable plugin installed, where an adversary could exploit the privilege escalation to gain higher access. While the concrete exploitation steps are not detailed in the description, the nature of privilege escalation implies that once the plugin is compromised, an attacker could execute privileged actions that threaten confidentiality, integrity, and availability of site data.