WordPress Cardealer Theme Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Cardealer theme for WordPress, affecting versions through 1.6.4. The issue arises from a missing capability check in the 'save_settings' function, allowing authenticated attackers with subscriber-level access and above to alter the default user role.

Impact

Exploitation of this vulnerability allows authenticated users with subscriber-level access to escalate privileges by modifying the default user role.

Remediation

Users can update to version 1.6.5 or a newer patched version to address this vulnerability.