Description

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-10-06T09:17:40.293Z",
  "pubdate": "2026-10-06T09:17:40.293Z",
  "executiveSummary": "The WP User Profiles plugin for WordPress, in versions up to and including 2.7.3, is susceptible to a privilege escalation vulnerability.\nThis security flaw allows authenticated users with the 'Subscriber' role to elevate their privileges to 'Administrator'.\nThe vulnerability arises from insufficient input validation and improper authorization checks during the user profile update process.\nBy manipulating HTTP requests to include unauthorized parameters, an attacker can modify sensitive user metadata and role assignments.\nSuccessful exploitation results in full administrative control over the affected WordPress instance, leading to total compromise of the application, data exfiltration, and potential server-side execution.\nThe risk is classified as critical due to the ease of exploitation by authenticated low-privileged users and the catastrophic impact on site security and integrity.",
  "technicalDetails": "The vulnerability exists within the user profile management functionality of the WP User Profiles plugin. The root cause of this flaw is the failure to adequately sanitize or restrict user-supplied input when processing profile update requests, coupled with a lack of server-side capability verification.\nSpecifically, the plugin exposes an endpoint designed to handle user profile modifications. During the update process, the application does not strictly validate the 'role' or 'user_level' parameters sent via the POST request. If these parameters are included in the request payload by a subscriber-level user, the backend process erroneously trusts the input and applies the changes to the user's database entry.\nThe attack flow proceeds as follows: First, the attacker authenticates as a standard subscriber. The attacker then crafts a malicious HTTP POST request targeting the profile update endpoint, explicitly including parameters that correlate to administrative privileges, such as 'role=administrator'. Because the plugin logic fails to enforce authorization checks against the current user's session capabilities, the application's underlying user management functions are invoked to update the user's record in the WordPress 'wp_users' or 'wp_usermeta' tables.\nUpon successful execution, the WordPress user object is updated with elevated privileges. Consequently, the attacker gains immediate access to the administrative dashboard, bypassing standard WordPress permission models. This post-exploitation state grants the attacker full control to perform administrative actions, including installing arbitrary plugins, modifying site content, creating new administrator accounts, and potentially executing arbitrary code via plugin or theme manipulation.\nThe exposure is restricted to authenticated users, meaning an attacker must have at least a registered subscriber account. The vulnerability is present in versions 2.7.3 and below, requiring no complex technical bypasses other than the manipulation of the request parameters to force the state change."
}