Access Dictionary
Privilege escalation
Definition
Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
Also called: privesc
Why it matters for WordPress
A bug that lets a Subscriber update options or upload PHP is effectively a full site takeover. Many plugin CVEs are “authenticated privilege escalation.”
How it shows up in practice
- New Administrator accounts created by a lower role
- CVE text: “Subscriber+ can … leading to RCE / admin access”
- Capability checks that only test
is_user_logged_in()instead of a real capability
What to do
- Update plugins when privilege-escalation CVEs appear. Do not wait for “it looks unused.”
- Keep the number of logged-in low-privilege accounts honest (spam registrations add attack surface).
- Monitor user role changes in an events log.
- Apply least privilege so a single escalated account is less common to begin with.
Related terms
Nearby ideas in the dictionary
- Least privilege Least privilege means each user and integration gets only the access required for their job, nothing more.
- Vulnerability A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- WordPress user roles User roles group capabilities that decide what each account can do in WordPress, from reading to full admin.