High · published October 15, 2025
⚡ A tiny oversight is all it takes for a Subscriber-level user to leap into the admin seat! The WPBifröst plugin for WordPress is letting users create new admin accounts without a hitch. 😱 Think of it like a restaurant where every diner at the table can magically upgrade their meal to a chef's special with no approval needed. Before long, everyone’s feasting like royalty! This vulnerability allows authenticated attackers to become admins by creating new accounts, giving them the keys to the whole establishment. They could wreak havoc—modify content, delete crucial data, or even lock out legitimate users. The potential for chaos is absolutely devastating!
Think of it like a restaurant where every diner at the table can magically upgrade their meal to a chef's special with no approval needed. Before long, everyone’s feasting like royalty! Due to a missing capability check on the ctl_create_link AJAX action, any user with Subscriber access can escalate their privileges and create new administrative accounts.
This vulnerability allows authenticated attackers to become admins by creating new accounts, giving them the keys to the whole establishment. They could wreak havoc—modify content, delete crucial data, or even lock out legitimate users. The potential for chaos is absolutely devastating! To secure your site, update the WPBifröst plugin to version 1.0.8 or later immediately. Additionally, review user roles and permissions to ensure no unauthorized access remains. Regular audits of user accounts can help maintain security. 🛡️ You've got this! Follow these steps to lock down your site and keep those pesky privilege escalators at bay! 🚀