This vulnerability in WP Masquerade involves improper management of user privileges, enabling an attacker with some level of access to escalate their privileges further. The issue affects all versions up to 1.1.0 of the plugin. The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, and impacts to confidentiality, integrity, and availability. No official fix or vendor advisory has been published yet, and no known exploits have been reported.

Successful exploitation could allow an attacker with limited privileges to escalate their privileges within the affected WordPress environment, potentially leading to full compromise of the site’s confidentiality, integrity, and availability. This could result in unauthorized access, modification, or disruption of site content or functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to trusted users only and monitoring for suspicious activity related to privilege escalation attempts. Avoid deploying this plugin in sensitive environments without additional compensating controls.