The plugin contains an incorrect privilege assignment flaw that allows a non‑administrator user to elevate their permissions to a level that grants full control over the WordPress site. This weakness is manifest as a direct privilege escalation vulnerability (CWE‑266). An attacker who can execute any code in the plugin’s context can potentially gain full administrative rights, compromising confidentiality, integrity, and availability of the entire website.

The vulnerability affects the RewardsWP plugin developed by Andrew Munro / AffiliateWP. Any installation running a version from the earliest releases up to and including 1.0.4 is susceptible. WordPress sites that have not upgraded past this version are at risk.

The CVSS base score of 9.8 highlights an extremely high severity, while the EPSS score of less than 1% suggests the exploit is unlikely to be widely observed at present. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector requires an authenticated user with limited privileges to interact with the plugin’s interface and manipulate the privilege assignment logic, after which they can assume full site administrator rights.