The Integração entre Eduzz e Woocommerce plugin allows an attacker who is authenticated with a Subscriber or higher role to modify the plugin’s default registration role. Because the ‘wep_opcoes’ function lacks a capability check, the attacker can change the role that new registrations receive from the default value to Administrator. Once an Administrator account is created, the attacker effectively gains full site control. This is a classic Missing Authorization flaw, identified as CWE‑862, and the CVSS score is 8.8 indicating high severity.

Impacted users run WordPress with the Integração entre Eduzz e Woocommerce plugin, versions 1.5.0 through 1.7.5, developed by felipe152. The plugin bridges the Eduzz marketplace with WooCommerce and is listed as a WordPress plugin in the WordPress plugin repository.

The CVSS score of 8.8 reflects the high impact of creating an Administrator account. The EPSS score is less than 1 % and the vulnerability is not included in CISA’s KEV catalogue, suggesting that widespread exploitation is not currently observed. However, the attack requires only that the user be logged in with a Subscriber‑level account, a role that many site owners assign to merchants or customers. Once these credentials are compromised, the attacker can elevate privileges swiftly. The exploitation path is therefore an authenticated privilege escalation via a missing capability check.