The WowOptin WordPress plugin contains a critical authorization flaw that allows authenticated users with low-level privileges to install and activate arbitrary plugins, potentially leading to full site compromise.

This vulnerability is caused by a missing capability check on the install_and_active_plugin function. It allows any authenticated user, including those with Subscriber-level access, to perform unauthorized plugin installations and activations.

The ability for a low-privileged user to install arbitrary plugins effectively grants them the capability to execute code on the server, modify site content, or exfiltrate sensitive data. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational security, as it provides a direct path for attackers to escalate privileges and gain full control over the WordPress environment.

Immediate Action: Update the WowOptin: Next-Gen Popup Maker plugin to version 1.4.25 or later to incorporate the necessary capability checks.

Proactive Monitoring: Audit the WordPress plugin directory for any unauthorized or unrecognized plugins that may have been installed recently.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict access to administrative functions and plugin installation endpoints for non-administrative user roles.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for complete system takeover, administrators should prioritize updating the WowOptin plugin immediately. If an update cannot be applied right away, consider deactivating the plugin until a secure version is deployed to prevent potential exploitation by malicious actors.