Description

The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, and who possess the access_key, to create a new user account with administrator privileges and gain full control over the WordPress site. The required access_key is intentionally shared with ThriveCart customers as part of the plugin's documented setup process, making it accessible to attackers who have made a purchase. The vulnerability is only exploitable when the ThriveCart Auto Login option is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T14:16:51.947Z",
  "pubdate": "2026-09-07T14:16:51.947Z",
  "executiveSummary": "The WP Fusion (Pro) plugin for WordPress contains a critical privilege escalation vulnerability due to improper authorization controls within its ThriveCart integration module. The flaw exists in the thrivecart() function, which processes auto-login requests.\nBy manipulating the role parameter during this process, an authenticated user—such as a Subscriber—can escalate their privileges to the Administrator level. The attack necessitates knowledge of a shared access_key, which is documented and provided to legitimate ThriveCart customers, lowering the barrier for exploitation by malicious actors.\nSuccessful exploitation grants an attacker full administrative control over the WordPress instance, leading to total system compromise, unauthorized data access, and potential remote code execution. The vulnerability affects all versions of the plugin up to and including 3.47.13. The risk is constrained to environments where the ThriveCart Auto Login feature is explicitly enabled, providing a direct vector for privilege manipulation via authorized but untrusted users.",
  "technicalDetails": "The vulnerability originates in the ThriveCart Auto Login handler, specifically within the thrivecart() function. The root cause is a failure to perform adequate authorization checks on the input parameters passed to the handler, specifically the role parameter used to assign user privileges during the automated account creation or login process.\nThe component responsible for this vulnerability is the ThriveCart integration logic. When the ThriveCart Auto Login feature is active, the plugin exposes an endpoint that listens for incoming POST requests. The handler processes these requests to facilitate user authentication and role assignment based on the data provided in the request payload.\nThe exploitation flow begins when an attacker, possessing at least Subscriber-level credentials, crafts a malicious request to the thrivecart() function. The attacker must include the valid access_key required by the plugin's integration logic. By tampering with the 'role' parameter in the payload, the attacker instructs the backend to assign the 'administrator' role to the user account associated with the request or the account being created/updated.\nBecause the function fails to validate whether the requester has the authority to assign administrative roles, it blindly updates the user's role in the WordPress database using the wp_update_user() function or similar native user-management APIs. Once the update is processed, the session state is effectively elevated, granting the attacker full administrative capabilities.\nAffected versions include all iterations up to and including 3.47.13. The exploit is highly efficient because it leverages existing legitimate functionality designed for customer integration. The exposure is limited to the web-accessible interface where the ThriveCart handler is listening. Post-exploitation impact is severe, as it allows the attacker to execute arbitrary administrative actions, such as installing malicious plugins, modifying database contents, or exfiltrating sensitive site configurations. The reliance on a shared access_key, which is meant for configuration purposes, serves as a static authentication token that attackers can obtain through legitimate purchase or unauthorized documentation disclosure."
}