A missing authorization vulnerability in the WP Adminify plugin allows low privileged users to perform unauthorized actions, posing a significant risk to administrative integrity.

This is a missing authorization flaw (CWE-862) within the WP Adminify plugin. The vulnerability requires the attacker to be an authenticated user, allowing them to bypass intended access control restrictions and perform unauthorized operations within the administrative interface.

The ability for low privileged users to manipulate administrative access controls can lead to unauthorized configuration changes, potential privilege escalation, or modification of critical site settings. With a CVSS score of 8.8, this vulnerability represents a high severity risk that could undermine the entire security posture of the WordPress installation and lead to full site compromise.

Immediate Action: Since no specific patch version is currently confirmed, administrators should monitor the official WordPress plugin repository for updates and move to version 4.0.6.2 or higher as soon as it becomes available.

Proactive Monitoring: Review WordPress audit logs for unusual administrative activity or unauthorized modifications to plugin settings performed by low privileged user accounts.

Compensating Controls: Implement a Web Application Firewall to block suspicious requests targeting administrative endpoints and restrict access to the WordPress dashboard to known, trusted IP addresses.

Public Exploit Available: exploit_available (false)

Given the high CVSS score and the sensitive nature of the WP Adminify plugin, this vulnerability must be treated with high priority. Organizations should immediately audit their current plugin version and be prepared to update as soon as the vendor releases a security patch. Until a patch is confirmed, enforcing the principle of least privilege for user accounts is essential to mitigate the potential for abuse.