The vulnerability arises from an authorization check missing in the infusedwoo_gdpr_upddata() function, allowing authenticated users with subscriber level or higher to update their own wp_capabilities user meta key. This flaw permits an attacker to grant themselves the Administrator role, effectively taking full control of the WordPress site. The weakness is identified as Missing Authorization, mapping to CWE-862.

WordPress sites running Infused Woo Pro plugin, versions 5.1.2 and earlier, distributed by Infused Addons.

The CVSS score of 8.8 reflects a high severity, and the EPSS information is currently unavailable. The vulnerability is not listed in CISA's KEV catalog. The likely attack path requires the attacker to first authenticate to the site with at least subscriber privileges, then invoke the vulnerable function to overwrite the wp_capabilities meta, elevating the account to Administrator.