Wordfence Warns of Active Exploits Targeting Critical Privilege Escalation Flaw in WP Freeio (CVE-2025-11533)

According to Wordfence, a critical privilege escalation vulnerability (CVE-2025-11533) in the WP Freeio plugin allows unauthenticated attackers to create administrator accounts by manipulating the user-role field during registration, with a CVSS of 9.8. The flaw resides in the plugin’s process_register() function inside the WP_Freeio_User class, which fails to restrict the role parameter, enabling attackers to define any role, including administrator.

Wordfence notes that exploitation began on the same day the vulnerability was disclosed, October 10, 2025, and that the Wordfence Firewall has already blocked over 33,200 exploit attempts targeting this vulnerability. The issue affects versions prior to 1.2.22, and attackers can gain full control of a site once elevated to administrator, including the ability to upload plugin and theme files and to modify posts and pages.

The publication also lists several IP addresses observed in exploitation campaigns and urges administrators to review web server logs for traffic from those addresses. Users are advised to update WP Freeio to version 1.2.22 or later, which tightens role assignment during registration.