Flex Store Users Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in the Flex Store Users plugin for WordPress, affecting all versions through 1.1.0. The issue arises because the 'fsUserHandle::signup' and 'fsSellerRole::add_role_seller' functions do not properly restrict the user roles that can be registered. This flaw allows unauthenticated attackers to register users with the 'administrator' role, thereby gaining administrative access to the site. The vulnerability can be exploited using the 'fs_type' parameter if the Flex Store Seller plugin is also activated.

Impact

Exploitation of this vulnerability allows unauthenticated users to gain administrative privileges on the WordPress site.