The PowerPack Pro for Elementor plugin for WordPress contains a CWE-732 vulnerability (incorrect permission assignment) that allows privilege escalation. Authenticated users with contributor-level permissions can create a registration form and set the default user role to administrator, thereby elevating their privileges upon registration. This affects all versions up to and including 2.10.17. The vulnerability has a CVSS 3.1 base score of 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or manual mitigation.

Successful exploitation allows an authenticated user with contributor-level access or higher to escalate privileges to administrator by creating a registration form with an administrator default role. This results in full administrative control over the WordPress site, compromising confidentiality, integrity, and availability. The vulnerability has a high CVSS score of 8.8, indicating a severe risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level users from creating or modifying registration forms or assigning roles. Monitor user role assignments closely and consider temporarily disabling the affected plugin if possible. Follow updates from the PowerPack vendor for an official fix.