CyberRota Analysis
AI-GeneratedThe Backstage - Customizer Demo Access plugin for WordPress is vulnerable to privilege escalation due to improper assignment of the `manage_options` capability to the `backstage_customizer_user` demo role, affecting all versions up to 1.4.2. This flaw allows unauthenticated attackers to modify critical WordPress options, potentially compromising site security. WordPress site administrators using this plugin should prioritize immediate updates to mitigate this high-severity vulnerability.
Original NVD Description
The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the `manage_options` capability to the `backstage_customizer_user` demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as `default_role`, leading to privilege escalation.