Critical · published December 11, 2025
🚨 Unauthenticated attackers can stroll right in and claim the 'administrator' role on WordPress sites with the WP CarDealer plugin! 🔥 It's like letting a random stranger into your office because they filled out a fake job application — no interview, no checks, just a badge to roam free! This vulnerability allows attackers to register themselves as administrators, giving them full control over the site. An attacker could change settings, delete content, and even siphon off sensitive data, which is absolutely devastating for any website owner!
It's like letting a random stranger into your office because they filled out a fake job application — no interview, no checks, just a badge to roam free! The issue lies in the 'WP_CarDealer_User::process_register' function failing to restrict user role assignments during registration, meaning anyone can register as an administrator without authentication.
This vulnerability allows attackers to register themselves as administrators, giving them full control over the site. An attacker could change settings, delete content, and even siphon off sensitive data, which is absolutely devastating for any website owner! Update the WP CarDealer plugin to the latest version immediately to fix this vulnerability. Implement additional checks on user role assignments during the registration process to enhance security. Don't forget to review your user roles and permissions for any suspicious accounts! You've got this! Patch it up and secure your site like the superhero you are! 🦸