The vulnerability arises from incorrect assignment of user privileges in the WordPress plugin The E-Commerce ERP, allowing a user to elevate their privileges beyond those intended. This flaw directly maps to CWE-266, as it permits malicious actors to gain administrative authority without proper authorization, potentially compromising the entire WordPress site.

The flaw affects Unity Business Technology Pty Ltd’s The E-Commerce ERP plugin up to and including version 2.1.1.3. All installations of this plugin within that version range are vulnerable.

The CVSS score of 9.8 signals a critical severity and the EPSS score of less than 1% indicates that actual exploitation is currently considered unlikely, and it is not listed in the CISA KEV catalog. The attack path most likely involves interacting with the plugin’s web interface, but the exact vector is not explicitly documented in the advisory, so this is inferred from typical WordPress plugin behavior. An attacker who can manipulate the plugin’s privilege logic can gain unrestricted administrative access to the WordPress installation.