The themekraft plugin for WordPress that manages frontend content forms for user submissions improperly manages privileges related to setting default user roles on registration forms. Specifically, it allows authenticated users with contributor-level permissions or above to create registration forms that assign a custom role, including administrator roles, to newly registered users. This vulnerability affects all plugin versions up to and including 2.8.11 and enables privilege escalation from contributor to administrator. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with contributor-level access or higher can escalate privileges to administrator by creating a registration form that assigns administrative roles to new users. This can result in full site compromise, including control over site content, user management, and potentially the underlying server environment depending on the hosting setup. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for suspicious registration form creation. Avoid using the affected plugin versions or disable the plugin if possible. Follow vendor updates closely for an official patch or temporary mitigation.