A critical privilege escalation vulnerability in the MailerPress WordPress plugin allows authenticated users to gain unauthorized administrative privileges.

The plugin suffers from an incorrect privilege assignment (CWE-266), where the application fails to properly validate the user's role before granting administrative capabilities to authenticated users.

Exploitation of this vulnerability grants attackers unauthorized control over the mailing and configuration functions of the plugin. Given the CVSS score of 8.8, this represents a major security risk that could lead to full site compromise or the exfiltration of subscriber data.

Immediate Action: Update the MailerPress plugin to the latest available version as soon as a patch is released by the vendor.

Proactive Monitoring: Monitor site logs for unusual activity regarding user role changes or unauthorized configuration modifications.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and inspect requests to ensure that administrative endpoints are restricted to authorized personnel only.

Public Exploit Available: Unknown.

Given the high CVSS score, immediate remediation is required to prevent potential privilege abuse. Security teams should ensure that all WordPress plugins, including MailerPress, are updated and that administrative access is strictly enforced.