A critical privilege escalation vulnerability in the bLoyal: Loyalty & Promotions by bLoyal plugin permits authenticated attackers to gain administrative privileges.

This vulnerability (CWE-269) stems from improper privilege management, which allows an authenticated user to perform unauthorized actions and escalate their account privileges within the WordPress environment.

Exploitation of this flaw grants an attacker administrative access, enabling them to exert full control over the website. This results in a total loss of confidentiality, integrity, and availability of the platform, posing a severe risk to business operations and customer data security.

Immediate Action: As there is no patch available, the plugin must be deactivated and removed from the environment immediately to prevent exploitation.

Proactive Monitoring: Audit existing user accounts for any unauthorized changes or newly created administrative accounts that may have been established during a period of compromise.

Compensating Controls: Restrict access to the WordPress dashboard and administrative functions via IP whitelisting or additional authentication layers to mitigate the risk of unauthorized privilege escalation.

Public Exploit Available: Unknown

Due to the high severity of privilege escalation, administrators must treat this as an urgent issue and remove the plugin immediately. Re-enable the software only after the vendor has provided a verified security update.