The WooCommerce plugin, versions 5.4.0 through 10.5.2, incorrectly processes batch REST requests, allowing an unauthenticated attacker to execute a logged‑in admin call to non‑store WooCommerce endpoints. By forging a CSRF request, the attacker can create arbitrary administrator accounts. This flaw constitutes a Cross‑Site Request Forgery (CWE‑352) and results in complete privilege escalation on the affected WordPress site.

The vulnerability affects the Automattic WooCommerce WordPress plugin. Impacted versions are 5.4.0, 5.4.1, 5.4.2, … up to 10.5.2. Users running any of these releases on a WordPress installation are at risk.

The CVSS score of 7.5 indicates a high level of severity, but the EPSS score of < 1% suggests that exploitation is unlikely at present. The flaw is not listed in CISA’s KEV catalog, yet it remains exploitable via a standard CSRF attack vector, requiring the victim to visit a malicious page while authenticated as an administrator. If an attacker can convince an admin to load a crafted page, they can create new admin users without any privilege checks.