A flaw in Estatik versions up to 4.3.5 allows a WordPress subscriber to raise their privileges to an administrator level. The weakness, documented as CWE-266, arises from insufficient checks of user capabilities before permitting access to privileged functions. If exploited, an attacker could modify site settings, upload malicious content, or otherwise compromise the integrity and availability of the entire WordPress installation.

The Estatik plugin for WordPress, versions 4.3.5 and earlier, is affected. This includes any website that has installed the plugin and has at least one subscriber account; the problem exists regardless of the core WordPress version.

The CVSS score of 9.8 marks this as a critical vulnerability. EPSS is not available, so the exact likelihood of exploitation cannot be quantified, but the high severity and the fact that it can be triggered by an authenticated subscriber suggest attackers will target vulnerable sites. The vulnerability is not included in CISA’s KEV catalog, which does not mitigate its risk. The likely attack vector is a web‑based request that exploits the plugin’s lack of proper authorization checks; a subscriber can trigger the privilege escalation through normal site interactions.