CVE-2023-1874

CVE-2023-1874 is a privilege escalation vulnerability affecting the WP Data Access plugin for WordPress, versions up to and including 5.3.7. It stems from insufficient authorization checks in the multiple_roles_update function, allowing authenticated users with low privileges (e.g., subscribers) to change their user role if the 'Enable role management' setting is active. This vulnerability carries a high CVSS score of 8.8, indicating a severe impact with high confidentiality, integrity, and availability risks, and can be exploited with low attack complexity. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules or significant community discussion surrounding this CVE.