A critical privilege escalation vulnerability in the Expire Users WordPress plugin allows authenticated users to gain administrative control over the affected site.

The vulnerability exists due to a missing authorization check in the save_extra_user_profile_fields function, which improperly handles the on_expire_default_to_role meta parameter. This flaw allows any authenticated user with Subscriber-level access or higher to modify their account privileges to those of an administrator.

Successful exploitation of this vulnerability results in full administrative compromise of the WordPress site. This grants the attacker complete control over site content, user management, and configuration, leading to a high risk of data theft, site defacement, or the installation of malicious backdoors. The CVSS score of 8.8 reflects the high severity of this impact, particularly for enterprise environments relying on WordPress for business operations.

Immediate Action: There is currently no patched version available; administrators should deactivate and remove the Expire Users plugin until a secure update is released by the vendor.

Proactive Monitoring: Review WordPress user audit logs for unauthorized role changes, specifically looking for users who have been granted the Administrator role unexpectedly.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block suspicious requests targeting profile update endpoints, though total mitigation requires removing the vulnerable code.

Public Exploit Available: Unknown.

Given the potential for total administrative takeover, immediate removal of the Expire Users plugin is the only effective way to eliminate this risk. Organizations should prioritize identifying all instances of this plugin across their WordPress infrastructure and ensure they are disabled until an official security release is verified.