CVE-2025-13764: Privilege Escalation in WP CarDealer

The impact of this vulnerability is severe. An unauthenticated attacker can exploit it to gain full administrative control over a WordPress site running an affected version of WP CarDealer. This grants them the ability to modify content, install malicious plugins, steal sensitive data (user credentials, financial information, customer data), and potentially compromise the entire server. The ease of exploitation, requiring only a crafted registration request, significantly increases the risk of widespread attacks. This vulnerability is particularly concerning given the popularity of WordPress and the potential for large-scale compromise.

1. Reserved2025-11-27
2. Published2025-12-11
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade the WP CarDealer plugin to version 1.2.17 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting user registration to trusted sources or implementing stricter role-based access controls within WordPress. While not a complete solution, a Web Application Firewall (WAF) could be configured to block suspicious registration requests containing administrator role assignments. Monitor WordPress logs for unusual registration attempts and newly created administrator accounts. After upgrading, verify the fix by attempting to register a new user with the 'administrator' role; the registration should fail.