The flaw in the WordPress Challan plugin (version 3.7.88 and older) permits a user with shop manager privileges to elevate their access level. Based on the description, it is inferred that an attacker could potentially gain administrative rights, enabling unauthorized modification of plugin settings, or other actions that compromise site integrity and confidentiality. The weakness stems from improper privilege handling, identified as CWE‑266.

WordPress Challan plugin (WebAppick Challan) for WordPress, versions 3.7.88 and older, across all sites that employ this plugin. Sites running these affected versions are vulnerable.

The CVSS score of 7.2 indicates high severity. The EPSS score of less than 1% signifies a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already possesses shop manager privileges; if such credentials are compromised or misassigned, the attacker can use the flaw to increase their role. Based on the description, it is inferred that a high‑privilege user could obtain full administrative control over the WordPress installation.