Description

Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-30T13:17:30.090Z",
  "pubdate": "2026-09-30T13:17:30.090Z",
  "executiveSummary": "The Estatik plugin, in versions 4.3.5 and earlier, contains a privilege escalation vulnerability that allows authenticated users with subscriber-level permissions to perform unauthorized administrative actions.\nThe flaw stems from insufficient server-side authorization checks within the plugin's request handling mechanisms.\nAn attacker with minimal subscriber access can exploit this vulnerability to execute sensitive functions reserved for privileged users, such as administrators.\nThis leads to a complete compromise of the plugin's configuration and potentially site-wide security implications, as attackers may manipulate real estate listings, plugin settings, or perform unauthorized data modifications.\nThe vulnerability is easily exploitable by any authenticated user, requiring no additional social engineering or specific network configuration, posing a high risk to the confidentiality, integrity, and availability of the affected WordPress environment.",
  "technicalDetails": "The vulnerability is rooted in improper access control validation within the Estatik plugin's internal request processing logic. Specifically, the affected component fails to verify the capability or role of the requester before executing administrative-level operations.\nIn Estatik versions 4.3.5 and earlier, several AJAX actions or POST request handlers do not implement proper 'current_user_can()' checks or nonce validation required to ensure the request originates from an authorized user context.\nThe attack flow begins when an authenticated subscriber identifies a target AJAX handler or administrative endpoint within the Estatik plugin structure. Because the application logic relies on client-side requests without robust server-side enforcement of user roles, the attacker can manipulate the request parameters to invoke sensitive functions.\nBy crafting a malicious HTTP request directed at the vulnerable endpoint—often involving specific 'action' parameters or plugin-defined hooks—the subscriber can trigger the execution of code designed for higher-privileged accounts. This effectively bypasses the expected WordPress role-based access control (RBAC) model.\nOnce the request reaches the vulnerable function, the application processes the instructions without verifying that the authenticated user possesses the 'manage_options' or similar administrative capabilities. This allows the attacker to manipulate plugin data, modify property listing configurations, or trigger secondary actions that may have further security implications within the WordPress installation.\nThe lack of strict authorization checks across multiple plugin components means that this is not limited to a single function, but rather a structural failure in how Estatik handles cross-privilege user requests. Post-exploitation impact includes the unauthorized creation or deletion of real estate data, potential injection of malicious scripts via plugin settings if input sanitization is also bypassed, and complete administrative control over the plugin’s functional scope."
}