To exploit this, an attacker must have at least Subscriber-level access on the target WordPress site. The attack requires the attacker to possess the access_key associated with the site's ThriveCart integration, which is typically shared during the plugin's documented setup process. When the ThriveCart Auto Login feature is enabled, an attacker can manipulate the request to create a new user account with administrator privileges. This flaw poses a significant risk to the integrity of affected WordPress installations, as it grants full administrative control to unauthorized parties who have access to the shared integration key.

Impact

Successful exploitation allows an authenticated Subscriber to escalate their privileges to Administrator, resulting in full site compromise. This can lead to total loss of control over the WordPress environment, including unauthorized data access, malicious plugin installation, and potential site-wide persistence.

Recommendation

• Upgrade the WP Fusion (Pro) plugin to a version newer than 3.47.13 immediately.
• Disable the ThriveCart Auto Login feature if it is not actively required for business operations.
• Audit existing administrator accounts to identify any unauthorized users created while the vulnerable version was active.
• Rotate the ThriveCart access_key if there is any suspicion of unauthorized access or exposure of the integration credentials.