The Lizza LMS Pro plugin for WordPress contains an improper privilege management vulnerability (CWE-269) in the 'lizza_lms_pro_register_user_front_end' function. This function fails to restrict the user roles that can be assigned during front-end registration, enabling unauthenticated attackers to specify the 'administrator' role. As a result, attackers can escalate privileges from unauthenticated to full administrator, compromising the entire site. The vulnerability affects all versions up to and including 1.0.3. The CVSS v3.1 base score is 9.8, reflecting its critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to gain administrator-level access to the WordPress site running the vulnerable Lizza LMS Pro plugin. This compromises site confidentiality, integrity, and availability, potentially leading to full site takeover, data theft, or site defacement.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the BuddhaThemes vendor advisory for updates and apply any official patches once released. Until a patch is available, consider disabling or removing the Lizza LMS Pro plugin to prevent exploitation. Restricting user registration or implementing additional access controls may reduce risk but will not fully mitigate the vulnerability.