The Media Manager for UserPro plugin for WordPress suffers from a missing capability check in the upm_upload_media() function in all versions up to and including 3.12.0. This authorization bypass allows authenticated users with low privileges (Subscriber and above) to update arbitrary WordPress options. Exploitation can result in changing the default registration role to administrator and enabling user registration, thereby escalating privileges and compromising site integrity. The vulnerability is tracked as CVE-2024-12821 and has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation enables attackers with minimal privileges to escalate to administrative access by modifying site options, including the default user role and registration settings. This compromises the confidentiality, integrity, and availability of the WordPress site, allowing full control over site content and configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and consider disabling or removing the Media Manager for UserPro plugin if not essential. Monitor for updates from DeluxeThemes and apply patches promptly once released.