Summary

Some WordPress plugins have a feature that allows administrators to assign permissions to users even if the users don't need them. An attacker could exploit this by creating an account with the required permissions and installing malicious plugins without being detected. To prevent this, ensure all users have only the necessary permissions.