Vehica Core WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Vehica Core plugin for WordPress, specifically in versions through 1.0.97. The issue arises because the plugin fails to properly validate user meta fields before updating them in the database. This flaw allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to Administrator.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling users with lower access rights to gain administrative privileges.

Remediation

Users are advised to update the Vehica Core plugin to version 1.0.98 or a newer patched version.