A critical vulnerability in the WP Component WordPress plugin allows unauthenticated attackers to gain full administrative control over the affected website.

The plugin lacks necessary capability and nonce verification for specific actions, enabling unauthenticated users to modify core site options. By injecting malicious values into the database, an attacker can modify registration settings to grant administrative privileges to any user.

Successful exploitation of this flaw grants an attacker complete control over the WordPress installation. This leads to total compromise of site data, potential redirection of traffic, and the ability to execute arbitrary code or deploy further malware. Given the CVSS score of 9.8, this vulnerability poses a catastrophic risk to business operations and data integrity.

Immediate Action: Since a specific patch version is currently unavailable, immediately deactivate and remove the WP Component plugin from the environment until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for unusual requests targeting administrative settings or modifications to the wp_options table.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block unauthorized requests to plugin-specific action endpoints that manage site configuration.

Public Exploit Available: Unknown

This vulnerability represents a severe security risk that permits complete site takeover without authentication. It is imperative that administrators identify and disable the affected plugin immediately to prevent unauthorized administrative access. Monitor vendor communications closely for the release of a patched version before considering re-deployment.