In Subscriptions for WooCommerce versions up to 2.0.0, the function that saves membership plan meta records the role assigned for members without applying a strict allowlist. The only checks performed are sanitization and a role existence test, both of which permit the value "administrator". An attacker with at least Contributor‑level access can bypass the client‑side disabled control on the role selector, submit a POST request setting the _wps_plan_user_role meta to "administrator", and the Pro companion plugin will later assign this role to the user when the membership lifecycle event fires. This allows an authenticated user to elevate their privileges to Administrator. The flaw hinges on the standard WordPress capability that permits any user who can edit posts to trigger the meta‑saving routine, because the custom post type is registered with a generic capability type. Therefore the exploitation path is direct and does not require additional privilege assumptions beyond the existing Contributor role. The vulnerability is a CWE‑269 Insecure Permission Assignment. While the exploit requires a compatible Pro plugin to process the stored meta, the impact is complete privilege escalation, giving the attacker full site control.

The affected product is the Subscriptions for WooCommerce WordPress plugin, versions 2.0.0 and earlier, together with its Pro companion plugin. Sites running either plugin combination and possessing users with Contributor or higher roles are susceptible. The vulnerability is not present in plugin versions beyond 2.0.0.

The vulnerability has a CVSS score of 8.8, indicating high severity, and an EPSS score of less than 1%, suggesting low current exploitation likelihood. It is not listed in the CISA KEV catalog. Attackers need only an authenticated Contributor or higher account and the Pro plugin active; the attack vector is purely internal (authenticated user). Because many WordPress sites assign Contributor roles, the potential attack surface is large, so the risk of a successful privilege escalation remains significant if the plugin is vulnerable.