Privilege Escalation Vulnerability in WP Freeio Plugin for WordPress

CVE-2025-11533

What is CVE-2025-11533?

The WP Freeio plugin for WordPress presents a privilege escalation flaw that impacts versions up to and including 1.2.21. This vulnerability arises from the process_register() function, which fails to enforce user role restrictions during user registration. Consequently, this oversight allows unauthenticated attackers to register with the 'administrator' role, providing them unauthorized administrative access to the WordPress site. Ensuring that user roles are properly validated during registration is crucial to maintaining the security of affected installations.

References