Critical WP Freeio Flaw Actively Exploited for Privilege Escalation (CVE-2025-11533)

TL;DR — Patch & Lock Registration, Then Hunt

• What: Unauthenticated privilege escalation in WP Freeio’s process_register() (role not restricted) → attacker self-registers as administrator. (CVSS 9.8)
• Affected: WP Freeio ≤ 1.2.21.
• Status: Active exploitation observed in the wild; incidents confirmed by security advisories.
• Fix: Update to 1.2.22+ (vendor/trackers list this as the first safe build).
• First steps: Disable public registration → patch → audit administrator accounts created recently → rotate secrets & harden.

About CVE-2025-11533

The flaw stems from WP Freeio’s registration handler failing to constrain the role that a new user can request. An attacker crafts a registration that includes the administrator role and immediately gains full control over the site (install plugins/themes, edit content, create backdoors). This behavior is explicitly described by national and vendor databases with CVSS 9.8.

Affected Versions & Fixed Release

• Vulnerable: All versions up to and including 1.2.21.
• Patched: 1.2.22+ is listed by trackers as the fix version. Update immediately across all environments (prod/stage/dev).
• Theme bundles: If you use the “Freeio” marketplace theme, verify the embedded plugin version and update the plugin directly even if the theme hasn’t shipped an update yet.

Detections & Hunts (Logs/DB)

Focus on the window between first exposure and your patch. Indicators:

• New admin users: Unknown administrator accounts created recently (esp. non-corporate emails).
• Registration bursts: Spikes of registrations from the same IP / ASN; odd user agents.
• Post-compromise behavior: Theme/plugin uploads, settings changes, creation of additional admin accounts, unexpected cron entries.

Quick checks (WP-CLI / SQL)

# List all administrators
wp user list --role=administrator --fields=ID,user_login,user_email,registered

# Show recently created users (last 7 days)
wp user list --field=ID --role=administrator --format=ids | xargs -I{} wp user get {} --field=registered

# SQL: find users with admin caps via usermeta
SELECT u.ID,u.user_login,u.user_email,um2.meta_value AS caps
FROM wp_users u
JOIN wp_usermeta um  ON um.user_id=u.ID AND um.meta_key='wp_capabilities'
LEFT JOIN wp_usermeta um2 ON um2.user_id=u.ID AND um2.meta_key='wp_user_level'
ORDER BY u.user_registered DESC;

Mitigation & Patch Checklist

1. Temporarily disable public registration: Settings → General → uncheck “Anyone can register” (or block registration routes at WAF) until patched.
2. Upgrade WP Freeio to 1.2.22+: Apply the plugin update. If bundled with a theme, update the plugin directly from the plugin ZIP/source.
3. Audit administrators: Remove unknown admins; force password resets for legitimate admins; rotate API keys (REST, SMTP, payment, CDN).
4. Backdoor sweep: Check wp-content/uploads, wp-includes, wp-admin for unexpected .php; verify wp-cron jobs and mu-plugins.
5. WAF rules: Block role assignment in registration payloads; rate-limit /wp-admin/admin-ajax.php and registration endpoints.

Hardening WordPress Registration & Roles

• Force default role to the lowest necessary (usually subscriber) and validate on the server side.
• Moderated onboarding: Require admin approval for elevated roles; disable direct “employer/freelancer” auto-roles until audited.
• Principle of least privilege: Review custom roles/capabilities; restrict file edits from the dashboard (DISALLOW_FILE_EDIT in wp-config.php).
• Security monitors: Enable login/role change alerts; maintain daily exports of users with admin caps.

FAQ

Is exploitation happening now?

Yes. Multiple advisories note active exploitation of vulnerable Freeio sites; treat this as an incident if you were running ≤ 1.2.21.

What exactly is the bug?

The registration handler (process_register()) does not restrict role selection, allowing unauthenticated users to request the administrator role during signup.

What version fixes it?

Tracker sources list 1.2.22 as the first patched version. Always upgrade to the latest available build.

Sources

• NVD — CVE-2025-11533 (description, CVSS 9.8, root cause). 
• INCIBE-CERT — Advisory summary confirming unauth-to-admin via process_register(). 
• Patchstack — Fixed version listed as 1.2.22; urgent patch priority. 
• GitHub Advisory (GHSA-9x94-9742-rrg5) — mirrors CVE details and severity. 
• Eventus Security — Notes active exploitation and recommends 1.2.22+.