WooCommerce Customers Manager Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the WooCommerce Customers Manager plugin for WordPress, affecting all versions through 31.3. The issue arises from a missing capability check in the ajax_assign_new_roles() function, allowing authenticated attackers with Subscriber-level access or higher to elevate their privileges to that of an administrator.

Impact

Exploitation of this vulnerability allows authenticated users to gain administrative privileges, potentially leading to unauthorized changes or access within the WordPress site.

Remediation

Users are advised to update the WooCommerce Customers Manager plugin to version 31.4 or a newer patched version.