A critical privilege escalation flaw in the TranslatePress WordPress plugin allows unauthenticated attackers to obtain unauthorized administrative privileges.

This vulnerability involves incorrect privilege assignment (CWE-266) within the TranslatePress plugin. It permits an unauthenticated attacker to escalate their privileges to an administrative level, effectively granting them full control over the affected WordPress installation.

A successful exploit provides an attacker with complete control over the WordPress site, leading to potential data theft, site defacement, or the installation of malicious software. With a CVSS score of 9.8, this vulnerability poses an extreme risk to the integrity and availability of the entire web platform.

Immediate Action: Update the TranslatePress plugin to version 3.3.3 or the latest available version immediately.

Proactive Monitoring: Audit user account creation logs for suspicious administrative account activity or unauthorized modifications to site configurations.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block common privilege escalation patterns targeting WordPress plugins.

Public Exploit Available: No (exploit_available: false)

Given the critical severity of this privilege escalation flaw, immediate remediation is required. Organizations should update the plugin without delay to prevent potential site takeover and ensure that all administrative accounts are reviewed for signs of unauthorized activity.