Authenticated User Role Escalation in Add User Autocomplete WordPress Plugin

Executive Summary

This vulnerability is a privilege escalation flaw in the WordPress plugin 'Add User Autocomplete' before version 1.2. It allows any authenticated user, even with low privileges like a subscriber, to grant themselves the administrator role on a multisite WordPress installation. This happens because the plugin does not check user capabilities or use nonce verification before creating a pending site-membership invitation with a specified role.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of the 'Add User Autocomplete' WordPress plugin. If it is below 1.2, the system is vulnerable. You can verify the plugin version via the WordPress admin dashboard under Plugins or by inspecting the plugin files directly.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to take full control of your WordPress multisite installation by gaining administrator privileges. This could lead to unauthorized changes, data theft, or complete site compromise. Attackers could install malicious plugins, modify content, or delete data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized access to sensitive data. If an attacker gains administrator access, they could exfiltrate personal or health data, violating confidentiality requirements. Organizations may face legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the 'Add User Autocomplete' plugin to version 1.2 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Additionally, review user roles and permissions to ensure no unauthorized administrator privileges have been granted.

Useful 0 Not Useful 0