The plugin performs an inadequate capability check on its post_save() handling routine, allowing any authenticated user who holds at least Editor rights to invoke setting updates. By manipulating these settings, an attacker could alter store configuration, potentially impacting pricing, checkout behavior, or other functional parameters. The flaw is an improper authorization issue (CWE-862).

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin, up to and including version 4.8.3, is susceptible. Users running these versions in WordPress environments are at risk when they grant Editor or higher role access to the site.

The CVSS score of 2.7 indicates low severity, and the EPSS score of < 1% reflects a very small likelihood of exploitation. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation would require legitimate authentication to the WordPress site with Editor‑level privileges, after which the attacker can submit a form that triggers the faulty capability check. No remote code execution or elevated system privileges are granted directly by this vulnerability, but the strategic impact of altering e‑commerce settings can be significant.