The CourseCure Courses plugin for WordPress versions up to and including 1.5.1 contains a privilege escalation vulnerability. This flaw arises from a missing capability check in the ajax_save_settings() function, allowing authenticated users with subscriber-level access or higher to modify WordPress options without proper authorization. Attackers can exploit this to set the default user role to administrator and enable user registration, thereby creating new administrator accounts.