The vulnerability is an unauthenticated privilege escalation flaw in the Tonda Membership WordPress plugin, versions 1.0.1 or earlier. Because the plugin lacks proper authorization checks on certain endpoints, a crafted request can be sent by any visitor to the site and cause the plugin to modify user capabilities, effectively granting the attacker administrator rights. This flaw is classified as CWE‑266, an Authorization Bypass Through Privileged Modification, and the high CVSS score of 9.8 reflects the potential for full control over site content, users, and the underlying server environment.

Affected products are the WordPress Tonda Membership plugin from Select‑Themes. The flaw applies to all installations running version 1.0.1 or older; no other products or versions are currently listed as impacted.

Because the vulnerability accepts unauthenticated input, any visitor could trigger it, resulting in a high risk profile. The CVSS score of 9.8 indicates critical severity, while the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, which does not reduce its threat. Attackers would likely target the plugin’s administrative hooks or callbacks via HTTP requests, sending specially crafted parameters to bypass the missing permission checks. In the absence of an official patch or workaround documented at the time of the advisory, the risk remains elevated until the plugin version is updated.