Vvveb prior to version 1.0.8.1 contains a flaw in the admin user profile save endpoint that allows an authenticated user to inject a role_id value of 1 into profile save requests. The resulting change elevates the attacker to Super Administrator status, which in turn provides access to plugin upload functionality and enables remote code execution. This weakness is mapped to CWE-915 (Insufficient Authorization).

The affected product is Vvveb, with all releases older than 1.0.8.1 vulnerable. Users running these versions should consider the software current as unpatched.

The vulnerability has a CVSS score of 8.7, indicating a high severity risk. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting that it is not known to be actively exploited in the wild yet, but the potential for privilege escalation and subsequent remote code execution makes it a critical concern. An attacker must first authenticate, then send a crafted request to the admin/user/save endpoint; successful exploitation results in super user privileges and the ability to upload malicious plugins.