WordPress Digits Plugin Missing Authorization Enables Admin Privilege Escalation

The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the `dig_update_wpwc_custom_fields()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator by submitting a forged `digits_reg_userrole` value during profile update, granted the site administrator has configured the built-in DIGITS User Role field.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Digits WordPress plugin contains a critical privilege escalation vulnerability in its user profile update function that fails to validate user roles before processing authorization-sensitive parameters. Any authenticated user—even those with basic Subscriber privileges—can exploit this flaw by submitting a forged `digits_reg_userrole` parameter to elevate themselves to Administrator status. This vulnerability affects all versions up to 9.1.0.5 and poses significant risk to WordPress installations relying on this plugin for authentication, as it completely undermines role-based access control mechanisms that are fundamental to WordPress security architecture.

Casky's 224 mapped skills detect this attack pattern through Claude AI's analysis of MITRE ATT&CK technique TA0004 (Privilege Escalation), identifying the behavioral indicators practitioners would observe: suspicious profile update requests containing role-elevation parameters, unexpected privilege transitions from low-level accounts to administrative access without corresponding admin actions, and unauthorized modifications to user_roles database fields. Practitioners monitoring with Casky would see findings flagging CWE-269 (Improper Access Control) violations—specifically missing authorization checks in the `dig_update_wpwc_custom_fields()` function—combined with behavioral anomalies showing Subscriber-level accounts suddenly gaining Administrator capabilities, enabling rapid incident response before attackers entrench themselves with admin-level persistence mechanisms.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13741.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-13741

Casky has 224 skills that investigate the attack patterns behind CVE-2026-13741. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn