Access Dictionary
Privilege escalation
Definition
Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
Also called: privesc
Why it matters for WordPress
A bug that lets a Subscriber update options or upload PHP is effectively a full site takeover. Many plugin CVEs are labeled “authenticated privilege escalation.” Spam registrations plus one of those bugs is a common combo.
How it shows up in practice
- New Administrator accounts created by a lower role
- Advisory text: “Subscriber+ can … leading to RCE / admin access”
- Capability checks that only test
is_user_logged_in()instead of a real capability - Membership or form plugins that quietly grant
upload_filesor worse
What to do
- Update plugins when privilege-escalation CVEs appear. Do not wait for “it looks unused.”
- Keep open registration honest; spam accounts add attack surface.
- Monitor user role changes in an events log.
- Apply least privilege so fewer accounts start near the danger line.
Related terms
Nearby ideas in the dictionary
- Least privilege Least privilege means each user and integration gets only the access required for their job, nothing more.
- Vulnerability A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- WordPress user roles User roles group capabilities that decide what each account can do in WordPress, from reading to full admin.
- Remote code execution Remote code execution is a vulnerability that lets an attacker run attacker-controlled code on the server.
- CVE A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.
