ShopEngine Elementor WooCommerce Builder Addon Incorrect Authorization Vulnerability for License Management

A vulnerability exists in the ShopEngine Elementor WooCommerce Builder Addon for WordPress, specifically in versions through 4.8.4. The issue arises from an inadequate capability check in the post_deactive() and post_activate() functions, allowing authenticated attackers with Editor-level access or higher to unauthorizedly activate or deactivate licenses.

Impact

Exploitation of this vulnerability allows for unauthorized modification of license statuses, enabling attackers to activate or deactivate licenses without proper authorization.

Remediation

Users can update to version 4.8.5 or a newer patched version to address this vulnerability.