This vulnerability in the WPLMS plugin by VibeThemes involves incorrect privilege assignment, which enables an attacker to escalate privileges within the affected system. The issue affects all versions up to 1.9.9. The CVSS 3.1 score of 9.8 reflects that the vulnerability is remotely exploitable without authentication or user interaction and can lead to complete compromise of confidentiality, integrity, and availability of the affected system. No patch or official remediation guidance is currently available from the vendor or other authoritative sources.

Successful exploitation of this vulnerability allows an attacker to escalate privileges, potentially gaining administrative control over the affected WPLMS installation. This can lead to full compromise of the system, including unauthorized access to sensitive data, modification or deletion of content, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the WPLMS plugin and monitoring for suspicious activity related to privilege escalation attempts. Avoid deploying this plugin in high-risk environments until a patch is available.