The WooCommerce Multiple Addresses plugin for WordPress contains a privilege escalation flaw that allows authenticated users with Subscriber-level access to modify protected user meta fields via the save_multiple_shipping_addresses() function. Because the function performs no capability checks, an attacker can alter role‑controlling fields and promote themselves to Administrator. This flaw is a CWE‑269 vulnerability, resulting in full administrative control over the site, including content, configuration, and user data.

The affected product is the WooCommerce Multiple Addresses plugin (author: n3wnormal) on WordPress sites. All released versions up to and including 1.0.7.1 are vulnerable. WordPress installations that have accepted the default or unmodified role capabilities for the plugin’s API are at risk.

The high CVSS score of 8.8 reflects the critical impact of gaining administrator privileges. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild as of the last measurement, though the flaw remains a significant risk in targeted or insider scenarios. The vulnerability requires an authenticated user with a Subscriber role or higher to trigger, so the attack vector is inferred to be internal or credential‑compromise based. The lack of a CISA KEV listing does not diminish the potential damage if the flaw is exploited.