CVE-2025-3101 is a privilege escalation vulnerability in the wp-configurator Configurator Theme Core WordPress plugin. The vulnerability is due to improper privilege management (CWE-269) where the plugin fails to properly validate user meta fields before updating them in the database. This flaw enables authenticated users with Subscriber-level privileges or higher to escalate their privileges to Administrator, potentially compromising the entire WordPress site. The vulnerability affects all versions up to and including 1.4.7. The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated user with minimal privileges (Subscriber or above) to escalate their privileges to Administrator. This can lead to full site compromise including unauthorized access to sensitive data, modification or deletion of content, and potential disruption of service. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor or security advisories for a patch or temporary mitigation.