Executive Summary

This vulnerability exists in the EduKart Pro WordPress plugin (versions up to 1.0.3) where the function 'edukart_pro_register_user_front_end' does not restrict the user roles that can be assigned during registration. As a result, an unauthenticated attacker can register with the 'administrator' role and gain full administrator access to the site.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can gain administrator privileges on the affected WordPress site without authentication. This allows them to fully control the site, including modifying content, installing malicious code, stealing data, or disrupting services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the EduKart Pro plugin to a version later than 1.0.3 where the privilege escalation issue is fixed. If an update is not available, restrict user registration or disable the vulnerable registration function 'edukart_pro_register_user_front_end' to prevent unauthenticated users from registering with the 'administrator' role.

Useful 0 Not Useful 0