---
title: Privilege escalation
canonical: https://wpsecurityninja.com/dictionary/privilege-escalation/
---
# Privilege escalation

Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.

Last updated: 2026-08-26

Also called: privesc

## Related terms

- [Least privilege](https://wpsecurityninja.com/dictionary/least-privilege/): Least privilege means each user and integration gets only the access required for their job, nothing more.
- [Vulnerability](https://wpsecurityninja.com/dictionary/vulnerability/): A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- [WordPress user roles](https://wpsecurityninja.com/dictionary/wordpress-user-roles/): User roles group capabilities that decide what each account can do in WordPress, from reading to full admin.
- [Remote code execution](https://wpsecurityninja.com/dictionary/remote-code-execution/): Remote code execution is a vulnerability that lets an attacker run attacker-controlled code on the server.
- [CVE](https://wpsecurityninja.com/dictionary/cve/): A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.

## Why it matters for WordPress

A bug that lets a Subscriber update options or upload PHP is effectively a full site takeover. Many plugin CVEs are labeled “authenticated privilege escalation.” Spam registrations plus one of those bugs is a common combo.

## How it shows up in practice

- New Administrator accounts created by a lower role
- Advisory text: “Subscriber+ can … leading to RCE / admin access”
- Capability checks that only test `is_user_logged_in()` instead of a real capability
- Membership or form plugins that quietly grant `upload_files` or worse

## What to do

1. Update plugins when privilege-escalation CVEs appear. Do not wait for “it looks unused.”
2. Keep open registration honest; spam accounts add attack surface.
3. Monitor user role changes in an events log.
4. Apply least privilege so fewer accounts start near the danger line.