The MultiLoca plugin for WordPress suffers a missing authorization check on its Ajax handler, enabling unauthenticated users to modify arbitrary WordPress options. This flaw can be abused to change the registration default role to administrator and to enable free user registration, effectively granting an attacker the ability to create an administrator account. The resulting privilege escalation violates confidentiality, integrity, and availability by allowing a malicious actor to assume full control of the web site.

All installations of Techspawn's MultiLoca – WooCommerce Multi Locations Inventory Management plugin for WordPress versions 4.2.8 and earlier are affected. The vulnerability resides in the 'wcmlim_settings_ajax_handler' function that handles configuration changes in the plugin.

The CVSS score of 9.8 marks this as critical, while the EPSS score of less than 1% implies an overall low probability of exploitation in the wild at this time. The flaw is listed as not in the CISA KEV catalog. An attacker would exploit the exposed Ajax endpoint by sending a crafted HTTP request without authentication, leveraging the lack of capability checks to update options. Successful exploitation escalates privileges to administrator, providing full control over the site.