WordPress users running the SUMO Memberships for WooCommerce plugin may be able to increase their privileges beyond the intended level due to incorrect privilege assignment. The flaw allows an attacker who can use the plugin’s administrative interface or craft malicious requests to gain elevated roles, potentially accessing sensitive site data or modifying content. The vulnerability’s core weakness is improper authorization (CWE‑266).

The plugin 'SUMO Memberships for WooCommerce' developed by FantasticPlugins. Versions from the first release up through 7.8.0 are affected. Any WordPress installation using the plugin prior to 7.8.1 is at risk.

The CVSS score of 8.8 indicates high severity, classifying it as high risk. The EPSS score is less than 1%, implying that active exploitation is currently rare, but the vulnerability is still present. It is not listed in the CISA KEV catalog, suggesting no widespread active exploitation has been reported yet. The likely attack vector is through the plugin’s administrative interface or crafted requests from a compromised low‑privilege account. Once exploited, an attacker can gain administrative rights or other elevated roles, enabling full control over the site.