Critical · published June 13, 2025
🚨 An unauthenticated POST could grant total control! With the Custom API Generator for WordPress, attackers can import malicious JSON to create an admin user without breaking a sweat. 🔥 Think of it like a restaurant with a secret back door. If the owner forgets to lock it, anyone can stroll in, create a VIP reservation, and start running the show without anyone noticing! This vulnerability is absolutely devastating! An attacker could create a new user with full Administrator privileges, allowing them to access sensitive data, modify site settings, and wreak havoc on your WordPress site. Imagine someone hijacking your entire platform with just one sneaky request!
Think of it like a restaurant with a secret back door. If the owner forgets to lock it, anyone can stroll in, create a VIP reservation, and start running the show without anyone noticing! The Privilege Escalation flaw in the REST API's process_handler() function lacks a capability check, enabling unauthenticated attackers to POST an arbitrary import_api URL and gain administrative access by importing crafted JSON.
This vulnerability is absolutely devastating! An attacker could create a new user with full Administrator privileges, allowing them to access sensitive data, modify site settings, and wreak havoc on your WordPress site. Imagine someone hijacking your entire platform with just one sneaky request! Immediately update the plugin to version 2.0.4 or later to close this loophole. Also, consider reviewing user roles and permissions to ensure no unauthorized changes have been made. Regularly audit your plugins to catch issues like this! You've got this! Follow these steps to secure your site and keep those pesky attackers at bay! 🛡️