The vulnerability occurs in the Productive Commerce WordPress plugin before version 1.1.49. An AJAX action within the plugin does not enforce a capability check and exposes its nonce on every admin‑area page. Because the nonce is available to all authenticated users, anyone with an account—including subscribers—can trigger the action to activate an arbitrary instance of the plugin that is already installed on the site. This allows a low‑privileged user to run the plugin’s code, effectively elevating their privileges within WordPress and potentially enabling the execution of malicious operations that the plugin might contain.

Any WordPress site using the Productive Commerce plugin version 1.1.48 or earlier is affected. The CNA indicates an unspecified vendor. Sites that have installed this plugin and have any authenticated users—especially subscribers—are at risk.

The vulnerability requires attacker authentication, but subscribers are a common role in many sites. The CVSS score is 4.3, and the EPSS score is less than 1%. The issue is not listed in CISA’s KEV catalog. Because the AJAX action lacks a capability check and the nonce is exposed, the attack can be performed with trivial effort once the attacker has logged in, and the exposed token enables the action without further interaction. In practice, the risk is moderate to high for sites with broad subscriber access, given the ability to activate plugins that can run arbitrary code.