The Vitepos plugin contains a custom role privilege escalation flaw that permits users with limited permissions to gain elevated access. An attacker who can create or manipulate custom roles can assign themselves administrative rights, potentially compromising the WordPress site. This flaw is classified as CWE-266, indicating an authorization bypass via privilege escalation.

The vulnerability affects the WordPress Vitepos plugin, offered by appsbd, version 3.5.0 and earlier. Users running these versions on their WordPress installations are at risk, and no additional affected versions are listed.

The CVSS score of 7.2 indicates a high risk. Because the EPSS score is not available, the exploit probability remains uncertain, and the vulnerability is not currently listed in CISA's KEV catalog. The flaw likely requires that an attacker has some level of access to the WordPress admin interface or is able to craft requests to the plugin's role management functions. Once leveraged, the attacker can elevate privileges to perform administrative actions, leading to full site compromise.