CVE-2025-13559 is a critical privilege escalation vulnerability in the EduKart Pro WordPress plugin by venusweb, affecting all versions up to 1.0.3. The vulnerability is due to improper privilege management (CWE-269) in the 'edukart_pro_register_user_front_end' function, which fails to restrict the user roles that can be assigned during registration. This allows unauthenticated attackers to specify the 'administrator' role and gain full administrative access to the WordPress site. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical impact and ease of exploitation over the network without authentication or user interaction. No patch or remediation details are currently provided, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation of this vulnerability results in an unauthenticated attacker gaining administrator privileges on the affected WordPress site. This grants full control over site content, configuration, and user management, severely compromising confidentiality, integrity, and availability of the site. The CVSS score of 9.8 reflects the critical nature and potential for complete site takeover. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is available, users should consider disabling or removing the EduKart Pro plugin until a vendor-provided update is released. Additionally, restricting access to the registration functionality or implementing custom validation to prevent unauthorized role assignment may mitigate risk temporarily. Monitor official venusweb communications for updates.