The Multiple Roles per User plugin for WordPress contains a critical authorization flaw that allows authenticated users with the edit_users capability to escalate their privileges to Administrator.

This vulnerability is caused by a missing capability check (CWE-862) within the plugin, which allows an authenticated attacker possessing the edit_users capability to modify user roles. An attacker can use this flaw to promote themselves or other accounts to the Administrator role or demote existing administrators.

Successful exploitation allows an attacker to gain full control over the WordPress site by escalating their account privileges. This leads to complete compromise of site integrity, potential data exfiltration, and the ability to perform administrative actions, which carries a high risk to business operations and data security. The CVSS score of 7.2 reflects the significant risk posed by unauthorized administrative access.

Immediate Action: Since a patched version is currently unavailable, administrators should immediately deactivate and remove the Multiple Roles per User plugin from the WordPress environment to eliminate the risk.

Proactive Monitoring: Review WordPress user account logs and audit trails for any suspicious role changes, particularly the promotion of standard users to administrative status.

Compensating Controls: Ensure that access to the WordPress administrative dashboard is restricted to authorized IP addresses and enforce the principle of least privilege regarding the assignment of the edit_users capability.

Public Exploit Available: No (exploit_available: false)

Given the severity of potential privilege escalation, IT teams must prioritize the immediate removal of the affected plugin. Until a secure version is released and verified, do not reinstall the plugin on production systems to prevent unauthorized administrative access and maintain site security.