External risk intelligence

WP CarDealer Plugin Privilege Escalation via Role Manipulation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-13764

The vulnerability exists in a WordPress plugin designed for public-facing automotive dealer websites. Registration and user account creation functions in such plugins are typically exposed to the public internet by design to allow users or customers to sign up for site accounts.

Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the WP CarDealer plugin for WordPress, which allows unauthorized users to gain administrator privileges on affected websites. This privilege escalation could enable malicious actors to take full control of a website without needing legitimate credentials.

Unauthenticated users can become administrators.
Protects public-facing websites from unauthorized control.
Confirm plugin relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by registering on a WordPress site that uses the WP CarDealer plugin. The plugin's registration function incorrectly allows any user to assign themselves the administrator role, bypassing normal permission checks and granting them full control over the website.

Attackers can register without prior authentication.
The registration process allows users to choose any role.
This can lead to an attacker gaining administrator access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the WP CarDealer plugin could allow an unauthenticated attacker to register with administrator privileges on a WordPress site. This occurs because the registration function does not adequately restrict the user roles that can be assigned, potentially leading to unauthorized control over the entire website.

Site administrator access.
Unauthenticated users can register.
Complete website compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and platform owners are responsible for addressing this critical privilege escalation vulnerability in the WP CarDealer plugin. The first step is to identify all WordPress sites using this plugin, confirm their internet reachability and business criticality, and then assign ownership for remediation planning.

Identify and triage affected sites.
Verify plugin reachability and impact.
Coordinate vendor update or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP CarDealer plugin?

WP CarDealer is a WordPress plugin specifically built for automotive websites. Dealerships use it to manage vehicle inventory, display car listings, and provide functional features for customers to interact with the site, including user registration modules that facilitate account creation for car buyers or interested visitors.

What does CVE-2025-13764 mean?

This CVE describes a Privilege Escalation vulnerability, categorized as CWE-269. In plain terms, it means the software fails to properly verify or restrict permissions during the account creation process. Instead of assigning a standard user role, the plugin allows a new registrant to arbitrarily assign themselves the highest level of system access, effectively making them an administrator.

How can an attacker trigger this vulnerability?

An attacker can exploit this by accessing the registration page provided by the plugin. During the sign-up process, they simply submit a request that includes the administrator role. The vulnerability does not require the attacker to have an existing account or password, as the plugin incorrectly processes the registration without validating the requested user role permissions.

Do I need to worry about this if my site is internal?

Halo Surface Signal indicates this plugin is primarily designed for public-facing automotive websites, making it highly accessible to the internet. If your installation is restricted to an internal network with no public access to the registration page, the immediate risk is significantly lower compared to a site fully exposed to the public web.

When should I take action for this plugin?

You should prioritize this immediately if you use WP CarDealer. First, perform an inventory to identify every WordPress installation running the affected plugin versions. Once identified, evaluate which sites are internet-facing and verify if they are using the registration functionality. Coordinate with your team to plan for updates or disable the registration feature until a patch is applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.