The Debugger & Troubleshooter plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to gain full administrative control over affected sites.

This vulnerability, categorized as CWE-565, stems from the plugin accepting a specific cookie value without cryptographic validation or authorization checks. An unauthenticated attacker can manipulate this cookie to impersonate any user, effectively bypassing all authentication controls.

Successful exploitation of this flaw grants an attacker full administrative access to the WordPress environment. This level of access enables the compromise of sensitive data, the injection of malicious content, the installation of backdoors, and potential full system takeover, posing a severe risk to site integrity and business operations. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate remediation.

Immediate Action: Update the Debugger & Troubleshooter plugin to version 1.4.0 or later immediately to implement the required cryptographic token validation.

Proactive Monitoring: Review WordPress administrative logs for unauthorized account creation or suspicious user activity that deviates from established administrative baselines.

Compensating Controls: If an immediate update is not feasible, deactivate the plugin entirely until the patch can be applied, as there are no effective WAF rules that can replace the necessary cryptographic validation logic.

Public Exploit Available: No

The severity of this vulnerability, combined with the ease of exploitation, necessitates an immediate response. Administrators must prioritize updating the plugin to version 1.4.0 to secure the site against unauthorized administrative access. Failure to address this flaw leaves the entire WordPress instance exposed to complete takeover by unauthenticated external actors.