What the vulnerability does
01Description
The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wep_opcoes' function in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the default registration role within the plugin's registration flow to Administrator, which allows any user to create an Administrator account.
Explanation of Vulnerability in Simple Terms
02Summary
The Eduzz-WooCommerce integration plugin through version 1.7.5 lacks proper authorization checks, allowing authenticated users to read, modify, or delete sensitive data and functionality without restriction. An attacker with a low-privilege account can escalate their access to perform actions reserved for administrators. This affects confidentiality, integrity, and availability of the WooCommerce store.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete store data and settings without proper authorization.
Potential impact on your site
04Site Impact
Store data, orders, and settings can be compromised by any authenticated user, including customers.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the WooCommerce site.
Key dates
06Disclosure timeline
April 26, 2025
CVE published
April 8, 2026
Record updated
