This CVE (CVSS 9.8) achieves unauthenticated full site compromise through a four-step chain that should concern every WordPress administrator: enable user registration, set default role to administrator, create an admin account, then optionally disable registration to cover tracks. The attack requires no skill, no tooling, no reconnaissance — it's a deterministic path from the internet to full control.
The vulnerability isn't a developer mistake. It's a design philosophy that WordPress's ecosystem actively rewards. The JSON Options plugin was built to update 'arbitrary WordPress options' — not because the developer overlooked security, but because WordPress's options API is so coarse-grained that the path of least resistance always leads to 'allow everything.' Developers must explicitly whitelist safe options or they get the nuclear default. That structural pressure isn't a moral failing; it's tool design creating inevitable failure modes.
What you should do now: First, audit your plugins for any that handle dynamic option updates without explicit allowlists — search your codebase for calls to update_option() or add_option() without capability checks and without a hardcoded list of permitted keys. Second, check your site's registration settings immediately; this attack chain begins with toggling 'users_can_register' and 'default_role' — if you don't need user registration, disable it at the application level, not just through a plugin. Third, review abandoned plugins: this vulnerable plugin sits at version 0.0.4, never matured, and was left installable — the WordPress plugin directory doesn't remove deprecated code, it just stops updating it.
This exact attack chain has recurred at least four times in eight years. The pattern is stable and deterministic, meaning it's not a matter of if another plugin arrives at the same dangerous pattern, but when. The low EPSS score (0.00341) likely reflects a small install base, not low attacker interest — the vulnerable population is simply too small for automated scanning to bother. That EPSS signal is the noise floor, not a safety signal. Your site is either patched or it's not; threat intelligence won't save you here.