WordPress Embedder Plugin Privilege Escalation Vulnerability

A vulnerability in the Embedder plugin for WordPress, affecting versions 1.3 to 1.3.5, allows authenticated users with Subscriber-level access and above to arbitrarily modify site options. This issue arises from a lack of proper capability checks in the ajax_set_global_option() function, enabling potential privilege escalation by, for example, changing the default role for new users to administrator and granting admin access to the attacker.

Impact

Exploitation of this vulnerability could lead to unauthorized administrative access on the affected WordPress site.