The vulnerability is an unauthenticated privilege escalation in the WordPress Support Board plugin prior to version 3.8.9. The flaw allows an attacker without credentials to gain elevated privileges within the WordPress installation, potentially enabling full control over the site. The weakness stems from improper authorization checks, identified as CWE-266.

This issue affects the Schiocco Support Board plugin for WordPress in all releases older than 3.8.9. Site administrators using these versions are at risk. The fix is to upgrade to version 3.8.9 or later, which removes the privilege escalation path.

The CVSS score of 9.8 indicates critical severity, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalogue. Nonetheless, it can be triggered without authentication, making any WordPress site exposed to the internet a valid target. Successful exploitation would grant the attacker administrator privileges, enabling complete takeover of the WordPress site.