The vulnerability allows an authenticated user with subscriber-level access to create an administrator account by bypassing capability checks and nonce verification when calling the wp_ajax_yith_wcwtl_add_user action. The missing checks enable the attacker to import attacker‑controlled data into wp_create_user and set the user role to administrator, resulting in full control over the site. This is a classic unauthorized privilege escalation flaw (CWE‑269).

This affect Yith’s YITH WooCommerce Waitlist Premium plugin for WordPress, in all releases up to and including version 3.35.0. System administrators should verify whether their site is running any of these affected versions.

The CVSS score of 8.8 indicates a high severity level. While the EPSS score is not available, the lack of a nonce and capability check makes exploitation straightforward for any authenticated user. The vulnerability is not listed in the CISA KEV catalog, but its impact is significant enough that no caveats should be applied. If the wp_ajax_yith_wcwtl_add_user endpoint is exposed, an attacker can create an admin user without further privilege escalation to reach higher privileges than originally available.