This vulnerability is an incorrect privilege assignment flaw (CWE‑266) in the Mestres do WP Checkout Mestres WP plugin that allows an attacker with lower‑level permissions to gain elevated access. The flaw lets a user reassign themselves or other user roles without proper checks, potentially giving them administrator privileges. Once elevated, the attacker could modify or delete site data, hijack transactions, or otherwise compromise the confidentiality, integrity, and availability of the WordPress site.

Affects the WordPress plugin Checkout Mestres WP from Mestres do WP, versions up to and including 8.7.5. Sites that have installed any of these versions and have the plugin active are vulnerable, regardless of current user role.

The EPSS score is below 1%, indicating a low overall probability of exploitation, but the CVSS score of 9.8 demonstrates a high potential impact. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely interact with the plugin’s interface or send a crafted request that triggers the privilege assignment logic, and could then elevate their role. Because the flaw resides in role management, it can be exploited by anyone with access to the plugin’s configuration pages or exposed endpoints.