A critical privilege escalation vulnerability in the WP Fusion (Pro) WordPress plugin allows authenticated attackers to gain full administrative control over the affected site.

This is a privilege management flaw (CWE-269) located in the thrivecart() function. Authenticated users with Subscriber-level access can manipulate the role parameter to promote themselves to administrator status if the ThriveCart Auto Login feature is enabled and they possess the access_key.

Successful exploitation results in full administrative compromise of the WordPress environment, granting the attacker total control over site content, user data, and system configurations. Given the high CVSS score of 7.5, this vulnerability represents a significant risk for data breaches and total loss of site integrity.

Immediate Action: Update the WP Fusion (Pro) plugin to version 3.47.14 or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Review WordPress user account logs for suspicious account creation or unexpected escalations in user roles, particularly involving the ThriveCart integration.

Compensating Controls: Disable the ThriveCart Auto Login feature until the plugin has been successfully updated to the patched version.

Public Exploit Available: No

Organizations utilizing the WP Fusion (Pro) plugin must prioritize this update to prevent unauthorized administrative escalation. The requirement for a specific access key does not mitigate the risk sufficiently, as this key is shared with all customers and can be obtained by malicious actors. Ensure all plugins are updated to the latest vendor-provided versions to secure the environment against this and other potential threats.