The Echo RSS Feed Post Generator plugin for WordPress suffers from improper privilege management (CWE-269) that enables unauthenticated attackers to escalate privileges by registering as administrators. This occurs because the plugin fails to properly restrict which roles can be assigned during user registration, specifically in the echo_check_post_header_sent() function. The vulnerability affects all versions up to and including 5.4.6. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No patch or vendor advisory detailing remediation is currently available, and the plugin is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation allows unauthenticated attackers to register as administrators on the affected WordPress site, granting them full control. This can lead to complete compromise of the website, including data theft, defacement, or further attacks on connected systems. The vulnerability impacts confidentiality, integrity, and availability severely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Echo RSS Feed Post Generator plugin to prevent exploitation. Monitor official CodeRevolution channels and WordPress plugin repositories for updates or patches addressing this vulnerability.