A critical privilege escalation vulnerability in the MVPThemes Jawn theme allows unauthenticated attackers to elevate their privileges to administrator status.

This is an incorrect privilege assignment vulnerability (CWE-266) that permits unauthenticated users to modify their account roles or gain unauthorized access to administrative functions.

A CVSS score of 9.8 reflects the extreme impact of this vulnerability, as it allows for the complete takeover of the WordPress instance by an unauthenticated attacker. Unauthorized administrative access can lead to the theft of customer data, the defacement of the website, or the redirection of traffic to malicious external sites.

Immediate Action: Update the Jawn theme to the latest version as soon as an update is released by the vendor.

Proactive Monitoring: Audit WordPress user accounts for unauthorized administrative users and monitor for suspicious authentication logs or password changes.

Compensating Controls: Implement strict access controls and consider disabling user registration or limiting administrative access to known IP addresses while a patch is awaited.

Public Exploit Available: Unknown

Administrators must treat this vulnerability with the highest urgency. Ensure that the MVPThemes Jawn theme is patched to the latest version immediately upon the release of a fix, and conduct a thorough audit of all existing user accounts to ensure no unauthorized administrative access has already occurred.