The vulnerability allows an authenticated user with a low privilege role, such as editor, to create new user accounts and assign the highly privileged admin role. As a result, the attacker can gain full administrative control over the CMS, compromising confidentiality, integrity, and availability of the site.

Formwork CMS versions 2.0.0 through 2.3.3 are affected. The issue is fixed in version 2.3.4 and later releases.

The CVSS score of 8.8 indicates a high severity. The EPSS score is less than 1 percent, suggesting limited exploitation probability at present. The vulnerability has not been listed in the CISA KEV catalog. Attackers only need to be authenticated with an editor role; the flaw lies in missing privilege checks during account creation, and no additional conditions are required to exploit it.