A critical vulnerability in the Videospirecore Theme Plugin allows authenticated attackers to escalate privileges and perform account takeovers, potentially leading to a full site compromise.

This is an authorization bypass vulnerability (CWE-639) where the plugin fails to validate user identity during profile updates. Authenticated attackers with Subscriber-level access can modify the email addresses of other users, including administrators, to initiate password resets and seize control of those accounts.

The ability for a low-privileged user to escalate to administrative access poses a severe risk to organizational data and system integrity. Successful exploitation could result in full site takeover, unauthorized access to sensitive user information, and potential malware distribution via the compromised administrative interface. Given the CVSS score of 8.8, this vulnerability represents a High-severity threat to business continuity and security.

Immediate Action: As no specific patched version is currently confirmed, administrators should immediately deactivate and remove the Videospirecore Theme Plugin until a security update is released by the vendor.

Proactive Monitoring: Review WordPress user account activity logs for unauthorized email changes or suspicious password reset requests, particularly for accounts with administrative privileges.

Compensating Controls: Implement a Web Application Firewall (WAF) to monitor for and block suspicious requests targeting profile update endpoints, although deactivation remains the only guaranteed mitigation.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a clear path to administrative account takeover, which is a critical security failure. Because the plugin does not implement proper capability checks, it is inherently insecure for any environment requiring multi-user access. We strongly recommend removing the plugin from your WordPress installation immediately and auditing all user accounts for unauthorized changes made within the last 30 days.