Introduction
An unauthenticated attacker can create an administrator account on WordPress sites running WP Freeio versions up to 1.2.21. No credentials are needed. Left unpatched, the flaw allows complete site takeover and persistent compromise.
ApusThemes develops WP Freeio and distributes it primarily through ThemeForest. The plugin is a core component of freelance marketplace sites built on WordPress, and site operators use it widely to launch Upwork-style platforms with minimal custom development. It handles user registration, job posting, and role management, so a security flaw in the plugin puts the integrity of every site that deploys it at risk.
Technical information
CVE-2025-11533 is a privilege escalation vulnerability in the process_register() function of WP Freeio, affecting all versions up to and including 1.2.21. The registration logic does not restrict which WordPress user roles a new account can receive.
An attacker can submit a registration request (through the public registration form or a direct HTTP POST) and specify the administrator role in the registration data. Because process_register() does not validate or limit the roles it assigns, the plugin creates a new user account with administrator privileges. This is a classic case of improper privilege management (CWE-269).
No authentication or prior access is required. The attacker only needs to reach the registration endpoint, which is typically public on sites using WP Freeio. The flaw is therefore remotely exploitable, and attackers can automate attacks across multiple sites. With an administrator account, the attacker can install plugins, modify site content, access sensitive data, and establish persistence.
Affected systems and versions
- Product: WP Freeio plugin for WordPress
- Affected versions: All versions up to and including 1.2.21
- Vulnerable configuration: Any WordPress site with WP Freeio <= 1.2.21 and user registration enabled
- Patched in: Version 1.2.22
Vendor security history
ApusThemes, the developer of WP Freeio, has a portfolio of commercial WordPress marketplace and directory themes. There is no public record of identical privilege escalation vulnerabilities in earlier versions of WP Freeio. The vendor responded promptly to this CVE with a patch in version 1.2.22. Still, a privilege management flaw this fundamental shows the need for better security review and development practices. Other WordPress plugins have had similar vulnerabilities, which points to a problem across the wider ecosystem.
