A critical privilege escalation vulnerability in the Progress Planner plugin allows authenticated users to gain unauthorized administrative access, posing a severe risk to site integrity.

The flaw stems from an incorrect privilege assignment (CWE-266), which permits an authenticated user to escalate their current access level. Based on the CVSS vector (PR:L), this attack requires an existing user account to initiate the exploit.

Successful exploitation of this vulnerability allows an attacker to gain elevated privileges, potentially leading to full administrative control over the affected WordPress instance. With a CVSS score of 8.8, this represents a high-severity risk that could lead to complete data compromise, unauthorized modification of site content, and potential service disruption.

Immediate Action: As no specific patch version is currently confirmed, administrators should immediately deactivate and remove the Progress Planner plugin until a secure update is released by the vendor.

Proactive Monitoring: Review user account logs for any unexpected changes in privilege levels or the creation of new administrator accounts that do not correlate with authorized maintenance activities.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block suspicious requests directed at user management or profile update endpoints associated with the plugin.

Public Exploit Available: No confirmed public exploit is available based on current data.

Given the potential for complete system compromise, organizations currently utilizing the Progress Planner plugin must prioritize its removal from their environments. Until the vendor provides a verified fix, deactivation remains the most effective method to neutralize this risk and prevent unauthorized privilege elevation.