The Webo-facto plugin for WordPress suffers from improper privilege management (CWE-269) in versions up to and including 1.40. Specifically, the 'doSsoAuthentification' function does not sufficiently restrict user registration, enabling unauthenticated attackers to escalate privileges by registering a username containing the string '-wfuser'. This flaw allows attackers to gain administrator-level access without authentication. The vulnerability is publicly documented as CVE-2024-8853 with a CVSS 3.1 base score of 9.8, reflecting its critical severity. No patch or remediation details have been provided by the vendor or in the advisory data.

Successful exploitation allows unauthenticated attackers to escalate privileges to administrator level on affected WordPress sites using the Webo-facto plugin. This compromises the confidentiality, integrity, and availability of the affected system, enabling full control over the site and potentially leading to further malicious activities such as data theft, site defacement, or malware deployment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing the Webo-facto plugin to prevent exploitation. Monitor official channels for updates regarding patches or mitigations.