Technical impact
The vulnerability occurs in the Welcome Software Publishing plugin for WordPress versions up to 0.0.31. An XML‑RPC method, nc.setOption, is exposed that authenticates the user but skips a capability check. An attacker who can log in with any role as low as Subscriber can send a crafted XML‑RPC request to update any WordPress option. By changing the default_role option to administrator and then creating a new administrator account, the attacker gains full control of the site.
Affected Systems
Vendor newscred:Welcome Software Publishing. Product: Welcome Software Publishing plugin for WordPress. Vulnerable versions: all releases up to and including 0.0.31. No newer versions are listed as affected.
Risk and Exploitability
The CVSS v3.1 base score is 8.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires a valid user account with Subscriber or higher privileges and the ability to send XML‑RPC requests, which is typically permitted by default in WordPress installations. Once the attacker modifies the default_role setting, creating an administrator account can be achieved without further authentication, leading to full site takeover. While the vulnerability can only be exploited by authenticated users, no additional network restriction is necessary for exploitation; an attacker can target the site from anywhere that can reach its XML‑RPC endpoint.
