The WPify Woo plugin exposes a REST route (POST /wp-json/wpify-woo/v1/option) that accepts arbitrary option names and values and writes them to the WordPress database using update_option() without any whitelist or sanitization. The route’s permission callback only checks for the manage_woocommerce capability, which is granted to Shop Manager roles and above. An authenticated attacker with a Shop Manager or higher role can thus overwrite core WordPress options such as default_role or active_plugins, elevating their privileges to Administrator. This flaw directly translates to a classic privilege escalation vulnerability (CWE‑269).

WordPress sites running the WPify Woo plugin version 5.4.16 or earlier are affected. The vendor is wpify, offering the WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce package. No newer version number is specified, so all releases up to and including 5.4.16 must be considered vulnerable.

The CVSS score of 8 indicates high severity, while the EPSS score of < 1% reflects a low yet non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not widely known to be actively exploited. Exploitability requires the attacker to be authenticated with at least Shop Manager access, so the risk is limited to compromised or over‑privileged users. When combined with an attacker’s ability to modify critical options, the potential impact includes full administrative control of the WordPress site and the disabling of security measures.