Introduction
Attackers can take full administrative control of WordPress sites running the Simple User Capabilities plugin up to version 1.0 by exploiting a missing capability check. Any user account can escalate its privileges, and in some configurations so can unauthenticated attackers. The result is total site compromise.
About Simple User Capabilities: Simple User Capabilities is a WordPress plugin that lets site administrators manage user capabilities at a fine-grained level. It is distributed through the official WordPress plugin repository, and its users are WordPress administrators who need more control over permissions than the default role system gives them. At the time of this disclosure, version 1.0 is the only version available. There is no evidence that the vendor has a mature security process or any prior vulnerability history.
Technical information
The vulnerability is in the suc_submit_capabilities() function of the Simple User Capabilities plugin. The function is exposed through a WordPress AJAX endpoint and is meant to let administrators change user capabilities, but it never performs a capability check before processing a request.
Mechanism:
- A requester can trigger the function by sending a POST request to
wp-admin/admin-ajax.phpwith theactionparameter set to the vulnerable function name (e.g.,suc_submit_capabilities). - The request can name the target user and the capabilities to apply.
- The plugin does not check whether the requester has sufficient privileges (such as
manage_optionsorpromote_users) before applying the changes. - If the AJAX endpoint is registered with
wp_ajax_nopriv_or lacks authentication checks, unauthenticated users can exploit the flaw.
Root cause:
The vulnerable function makes no call to WordPress's current_user_can() or any similar authorization check. This is a classic case of CWE-862 (Missing Authorization), in which access control is not enforced on a sensitive operation.
Impact: Any user can escalate their own account, or any other account, to administrator. Depending on how the endpoint is registered, that includes unauthenticated attackers. Attackers can automate exploitation by crafting POST requests to the AJAX handler.
No public code snippet of this function is available, but public advisories and plugin source references confirm the vulnerability.
Affected systems and versions
- Product: Simple User Capabilities WordPress plugin
- Affected versions: All versions up to and including 1.0
- Vulnerable configuration: Any WordPress site with the plugin installed and active. Unauthenticated users may be able to exploit it if the endpoint is exposed via
wp_ajax_nopriv_or lacks authentication checks.
Vendor security history
- No public record of previous vulnerabilities in Simple User Capabilities.
- No evidence of a mature security response process or a history of timely patching.
- Version 1.0 was the only version available at the time of this disclosure.
