The WowRevenue plugin for WordPress contains a missing capability check in the Notice::install_activate_plugin function that allows authenticated users with subscriber-level access to install arbitrary plugins. This flaw is a classic missing authorization issue (CWE-862). An attacker who can log in as a subscriber can use the publish‑edit interface to activate a malicious plugin, which may contain code that can be executed on the server, thereby compromising confidentiality, integrity, and availability of the site.

Vendor: wpxpo – WowRevenue – Product Bundles & Bulk Discounts. The plugin version 2.1.3 and earlier are affected. Users employing this plugin on any WordPress installation are potentially vulnerable until a patch or later release is applied.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% denotes a very low exploitation probability at the time of analysis. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no publicly known exploits yet. The likely attack path involves authenticating as a subscriber, invoking the vulnerable installation routine, and enrolling a malicious plugin that can execute arbitrary code on the server.