The Templines Elementor Helper Core plugin for WordPress contains a privilege escalation vulnerability (CWE-269) in all versions up to and including 2.7. The flaw arises from the plugin allowing arbitrary updates to user meta data, which enables authenticated users with low-level privileges (Subscriber and above) to modify their role to Administrator. Exploitation is contingent on the presence and activation of the BuddyPress plugin. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation results in an attacker with Subscriber-level access escalating their privileges to Administrator, granting full control over the WordPress site. This can lead to complete compromise of the affected site, including data theft, site defacement, or further malicious activity. The vulnerability requires BuddyPress to be active, limiting the scope to environments where both plugins coexist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or uninstall the Templines Elementor Helper Core plugin or BuddyPress plugin if not essential, to prevent exploitation. Monitor official Templines communications for updates and apply patches promptly once available.