Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wp_ajax_pos_get_option AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via admin_enqueue_scripts — without any capability check — before returning the value of any arbitrary WordPress option via get_option(), combined with the admin_login_endpoint_handler REST endpoint (GET /wp-json/epm/v1/admin/login) being registered as publicly accessible and authenticating callers solely by a whirlpool hash of values stored in those same options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the site_url, connection_key, and remote_user_id values stored in the eazywp_connecting_info and eazywp_connection options, compute the required auth_key, call the admin/login REST endpoint to obtain Administrator authentication cookies, and fully take over the site. Exploitation requires the plugin's remote connection feature to have been configured, as the eazywp_connecting_info and eazywp_connection options must be populated with valid credentials.