The Expire Users plugin for WordPress has a flaw that allows any authenticated user with the role of Subscriber or higher to manipulate the 'on_expire_default_to_role' meta field through the save_extra_user_profile_fields function. By updating this field, an attacker can grant themselves administrator privileges, effectively compromising the entire site. This vulnerability directly affects confidentiality, integrity, and availability by enabling a non‑admin user to gain full control over the WordPress installation.

WordPress sites that install the Expire Users plugin, versions 1.2.2 and earlier, provided by the vendor husobj. Users of any WordPress installation where this plugin is active and enabled are at risk, regardless of other plugins or themes in use.

The CVSS score of 8.8 indicates a high severity, and because the exploit requires only authentication with a role of Subscriber or above, it is highly likely to be used in the wild. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is straightforward: an authenticated user logs in, accesses the user profile edit page, and submits a payload to change the meta field, granting themselves administrator rights.