Croma Music WordPress Plugin Privilege Escalation Vulnerability

A vulnerability in the Croma Music plugin for WordPress, present in versions through 3.6, allows authenticated users with Subscriber-level access and above to arbitrarily modify options on the WordPress site. This issue arises from a missing capability check in the 'ironMusic_ajax' function, which can be exploited to escalate privileges by changing the default role for new users to administrator and enabling user registration, potentially leading to unauthorized administrative access.

Impact

Exploitation of this vulnerability could result in unauthorized administrative access to a WordPress site by allowing attackers to change user roles and permissions.

Remediation

Users are advised to update the Croma Music plugin to version 3.6.1 or later.