Technical impact
The Digits plugin for WordPress exposes an unauthenticated privilege escalation flaw. Based on the description, it is inferred that an attacker does not need to log in or provide any credentials to exploit the vulnerability. By sending a specially crafted request, the attacker can trigger a function that upgrades a user’s role to administrator. The resulting impact is complete control over the site, enabling content modification, plugin installation, and configuration changes.
Affected Systems
Affected systems are WordPress installations that include the UnitedOver, LLC Digits plugin version 9.2 or older. The plugin is typically listed as Digits or UnitedOver Digits in the WordPress plugins directory. Any WordPress site running a Digits version less than or equal to 9.2 should be considered vulnerable.
Risk and Exploitability
The CVSS score of 9.8 indicates a critical severity. The EPSS score is not available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is a network-based HTTP request to the WordPress site; authentication is not required. If not patched, a single crafted request could lead to full site compromise.
