CVE-2024-9192 is a high-severity privilege escalation vulnerability (CWE-269) in the WordPress Video Robot plugin. The issue arises from improper validation of user meta updates in the wpvr_rate_request_result() function, enabling authenticated users with low-level privileges to modify their capabilities to administrator level. This vulnerability affects all versions up to and including 1.20.0 of the plugin. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the level of a subscriber or higher, no user interaction, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability allows an authenticated user with subscriber-level access or above to escalate their privileges to administrator. This can lead to full site compromise, including the ability to modify content, install malicious plugins, and access sensitive data. The vulnerability poses a significant risk to the confidentiality, integrity, and availability of affected WordPress sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only or disable the plugin if possible. Monitor for updates from the vendor or plugin author and apply patches promptly once available.