The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is compromised by an insufficient capability check in the post_deactivate() and post_activate() functions in all releases up to 4.8.4. This flaw permits an authenticated attacker with Editor-level access or higher to toggle the license status of the plugin, effectively enabling or disabling license protection without proper authorization. The vulnerability represents a classic example of insufficient authorization (CWE‑863) and could allow attackers to bypass licensing restrictions, potentially leading to unauthorized use of premium features.

The affected installation is the ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress, specifically versions 4.8.4 and earlier. Any WordPress site that has installed these versions and grants Editor or higher roles to users is at risk.

With a CVSS score of 2.7, the weakness poses a low overall risk; the EPSS score of less than 1 % indicates that actual exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. Nevertheless, the attack requires only an authenticated account with Editor privileges or higher, making the barrier to exploitation relatively low in environments where such roles are widely granted.