A high-severity privilege escalation flaw in the Gato GraphQL WordPress plugin allows authenticated subscribers to gain unauthorized administrative access.

The vulnerability is an incorrect privilege assignment (CWE-266) within the Gato GraphQL plugin. An attacker with standard subscriber-level authentication can exploit this flaw to escalate their privileges, potentially gaining full control over the affected WordPress instance.

This vulnerability poses a significant risk to organizational security, as it allows low-privileged users to bypass access controls and potentially perform administrative functions. With a CVSS score of 8.8, the impact on confidentiality, integrity, and availability is considered high. Successful exploitation could lead to unauthorized data modification, site defacement, or complete administrative takeover of the WordPress environment.

Immediate Action: Update the Gato GraphQL plugin to version 19.2.4 or the latest available release immediately to patch the privilege assignment logic.

Proactive Monitoring: Review user account activity logs for anomalous escalations or unauthorized administrative actions performed by accounts originally created as subscribers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious GraphQL requests or unexpected API calls that may be utilized to trigger privilege changes.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete system compromise via privilege escalation, administrators must prioritize patching this plugin. Since the vulnerability is reachable by any authenticated subscriber, the window for remediation should be minimal. Apply the update to version 19.2.4 as soon as possible to neutralize this risk.