Privilege Escalation in WooCommerce Customers Manager Plugin for WordPress

CVE-2024-13343

Summary

The WooCommerce Customers Manager plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level access and above to manipulate user roles improperly. Specifically, the ajax_assign_new_roles() function lacks a vital capability check, enabling an attacker to escalate their privileges to that of an administrator. This flaw potentially allows them to perform unauthorized actions within the site, posing significant risks to the security and integrity of WordPress installations.

References