A critical privilege escalation vulnerability in the Add User Autocomplete WordPress plugin allows authenticated users to grant themselves administrative access, posing a severe risk to multisite environments.

This flaw is an Improper Privilege Management issue (CWE-269) where the plugin fails to perform necessary capability or nonce checks during the site-membership invitation process. Any authenticated user, including those with minimal subscriber privileges, can supply their own role and elevate their account to administrator status.

The ability for a standard user to gain administrative control over a WordPress multisite installation can lead to a complete system compromise. Attackers could manipulate site settings, access sensitive database information, or deploy malicious code across the entire network, resulting in significant data breaches and long-term operational disruption. The CVSS score of 8.8 reflects the high potential for total impact on confidentiality, integrity, and availability.

Immediate Action: Update the Add User Autocomplete plugin to version 1.2 or later immediately to resolve the missing capability checks.

Proactive Monitoring: Review user account logs for suspicious activity, specifically looking for unexpected changes in user roles or unauthorized elevation of privileges within the WordPress dashboard.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter unauthorized administrative requests and restrict access to sensitive plugin-related endpoints until the software can be updated.

Public Exploit Available: No (exploit_available: false)

The vulnerability represents a significant security risk for any organization utilizing the Add User Autocomplete plugin in a multisite configuration. Because the fix is available and directly addresses the improper privilege management, administrators must prioritize updating the plugin to version 1.2 across all affected sites to prevent potential unauthorized escalation.