CVE-2024-9518 is a critical privilege escalation vulnerability in the UserPlus WordPress plugin (versions up to 2.0). The issue stems from improper privilege management (CWE-269) where the plugin fails to sufficiently restrict access to 'form_actions' and 'userplus_update_user_profile' functions. This allows unauthenticated attackers to specify the 'role' parameter during user registration, effectively granting themselves elevated privileges. The vulnerability has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its ease of exploitation and high impact on confidentiality, integrity, and availability. No patch or official fix has been disclosed yet.

Successful exploitation allows unauthenticated attackers to escalate privileges by assigning themselves arbitrary user roles during registration. This can lead to full administrative control over the WordPress site, compromising confidentiality, integrity, and availability of the affected system. Given the critical CVSS score, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the UserPlus plugin if possible, or restrict access to registration endpoints through other means such as web application firewalls or access controls. Monitor vendor channels for updates and apply patches immediately once available.