The vulnerability resides in the /easycommerce/v1/orders REST API of the EasyCommerce WordPress plugin. The endpoint fails to enforce role restrictions during user registration, permitting any unauthenticated caller to specify an elevated role. This flaw allows an attacker with no credentials to submit a request that promotes the new user to an administrator, thereby gaining full control of the WordPress site. The flaw is a clear instance of improper authorization (CWE-269) that can compromise confidentiality, integrity, and availability.

The flaw affects EasyCommerce – AI‑Powered WordPress Ecommerce Plugin versions 0.9.0‑beta2 through 1.8.2. Any site running this plugin within that range is vulnerable, regardless of other configurations. The plugin is distributed via the official WordPress plugin repository and used to sell digital products, subscriptions, and physical goods.

With an unscoped Privilege Escalation CVSS score of 9.8, the risk is severe. The EPSS score is under 1 %, indicating that current automation targeting this issue is rare, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the attack vector is straightforward: a remote attacker can issue an unauthenticated REST request to the vulnerable endpoint, supply parameters that assign an administrator role, and immediately gain full administrative access. Because no authentication or privilege checks precede role assignment, exploitation requires minimal technical skill or resources.