The vulnerability in the XforWooCommerce Product Filter for WooCommerce plugin allows an attacker to improperly elevate privileges. The flaw stems from incorrect privilege assignment, enabling a lower‑privileged user to obtain higher level rights within the WordPress site. This is a classic example of CWE-266: Incorrect Privilege Assignment. Any escalation grants the attacker full control over the plugin and, potentially, deeper access to the WordPress backend, compromising confidentiality, integrity, and availability of site data.

WordPress sites that use the XforWooCommerce Product Filter for WooCommerce plugin, specifically versions up to and including 9.1.2. All earlier releases are also affected, as the issue is present from the initial version through 9.1.2.

The CVSS score is 7.2, indicating a high severity. The EPSS score is less than 1%, suggesting that the probability of exploitation is low at present. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is likely authenticated; a user with a normal WordPress role could trigger the flaw and raise their own privileges. The affected code path allows the attacker to gain capabilities beyond their current role, enabling further exploitation of the site.