A high-severity privilege escalation vulnerability in the Toret Manager WordPress plugin allows authenticated attackers to gain administrative control over the affected site.

The plugin suffers from improper privilege management due to missing capability checks on the trman_save_option and trman_save_option_items functions. This flaw enables any authenticated user, including those with Subscriber-level access, to modify arbitrary site options.

The ability to modify site options presents a critical risk, as an attacker can change the default user registration role to administrator or enable unauthorized user registration. This facilitates full administrative account takeover, leading to total compromise of the WordPress site, potential data exfiltration, and long-term persistence. Given the CVSS score of 8.8, this vulnerability represents a severe threat to the integrity and security of the application environment.

Immediate Action: Update the Toret Manager plugin to a version beyond 1.2.7 as specified in the vendor changeset. If an update is not immediately available or applicable, deactivate the plugin until a secure version is installed.

Proactive Monitoring: Monitor WordPress audit logs for unexpected changes to site options, particularly settings related to user registration roles and administrative privileges. Regularly review the list of administrator-level accounts for unauthorized additions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the vulnerable admin functions. Restrict access to the WordPress administrative dashboard to known, trusted IP addresses where feasible.

Public Exploit Available: No (exploit_available: unknown)

The severity of this vulnerability necessitates immediate attention to prevent full administrative takeover. Administrators should prioritize updating the Toret Manager plugin to the latest patched version. If the plugin is not essential for business operations, removing it entirely remains the most effective method to eliminate the attack surface.