---
title: Privilege escalation
canonical: https://wpsecurityninja.com/dictionary/privilege-escalation/
---
# Privilege escalation

Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.

## Why it matters for WordPress

A bug that lets a Subscriber update options or upload PHP is effectively a full site takeover. Many plugin CVEs are labeled “authenticated privilege escalation.” Spam registrations plus one of those bugs is a common combo.

## How it shows up in practice

- New Administrator accounts created by a lower role
- Advisory text: “Subscriber+ can … leading to RCE / admin access”
- Capability checks that only test `is_user_logged_in()` instead of a real capability
- Membership or form plugins that quietly grant `upload_files` or worse

## What to do

1. Update plugins when privilege-escalation CVEs appear. Do not wait for “it looks unused.”
2. Keep open registration honest; spam accounts add attack surface.
3. Monitor user role changes in an events log.
4. Apply least privilege so fewer accounts start near the danger line.