CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_assign_new_roles() function in all versions up to, and including, 31.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Explanation of Vulnerability in Simple Terms
WooCommerce Customers Manager versions 31.3 and earlier contain a privilege management flaw that allows authenticated users with low-level access to perform actions reserved for administrators. An attacker with a standard user account can read sensitive data, modify site content, and disrupt service without requiring additional interaction or elevated permissions.
What an attacker can do
Read sensitive data, modify site content, and disrupt service using a low-privilege user account.
Potential impact on your site
Any registered user can escalate their capabilities to perform admin-level actions on your WooCommerce store.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
