Subscriber-to-Administrator escalation via unrestricted user meta update

Privilege escalation in Thrive Themes Thrive Theme Builder before 3.24.0 allows remote authenticated users to become administrators. The action_dismiss_tooltip handler passes attacker-controlled meta_key and meta_value parameters to update_user_meta without restricting writable keys. A Subscriber account and a retrievable editor nonce are sufficient to rewrite the account's wp_capabilities value and take full control of the WordPress site.