Executive Summary

The Buyent Classified plugin for WordPress, which is bundled with the Buyent theme, has a vulnerability in all versions up to and including 1.0.7. This vulnerability allows privilege escalation through the user registration process. Specifically, the plugin does not validate or restrict the user role during registration via its REST API endpoint.

An unauthenticated attacker can exploit this by manipulating the _buyent_classified_user_type parameter during registration to assign themselves any user role, including administrator. This grants the attacker complete control over the WordPress site.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to gain administrator-level access without authentication. With such access, the attacker can fully control the WordPress site.

• Modify, delete, or create content arbitrarily.
• Install malicious plugins or themes.
• Access sensitive user data stored on the site.
• Use the compromised site as a platform for further attacks.
• Disrupt website availability or functionality.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

I don't know

Useful 0 Not Useful 0