Critical · published November 25, 2025
🚨 An unauthenticated user could easily register themselves as an administrator on your WordPress site, all thanks to a sneaky oversight in the EduKart Pro plugin! 🔥 Think of it like a party where anyone can just walk in and claim to be the host, bypassing the guest list entirely. Without proper checks, it's a recipe for chaos! If an attacker registers with the 'administrator' role, they could have complete control over your WordPress site—altering content, accessing sensitive data, or even locking you out completely. This level of access could lead to absolute devastation for your site's integrity and security!
Think of it like a party where anyone can just walk in and claim to be the host, bypassing the guest list entirely. Without proper checks, it's a recipe for chaos! This vulnerability arises from the 'edukart_pro_register_user_front_end' function failing to validate user roles during registration, allowing anyone to assign themselves any role, including 'administrator'.
If an attacker registers with the 'administrator' role, they could have complete control over your WordPress site—altering content, accessing sensitive data, or even locking you out completely. This level of access could lead to absolute devastation for your site's integrity and security! To safeguard your site, update the EduKart Pro plugin immediately to version 1.0.4 or later. Additionally, review user registrations and implement role checks to ensure unauthorized roles cannot be assigned. 🛡️ You’ve got this! By taking these steps, you’re well on your way to securing your site and keeping those intruders at bay! ✨