Checkout Mestres do WP for WooCommerce Unauthenticated Privilege Escalation Vulnerability

A vulnerability exists in the Checkout Mestres do WP for WooCommerce plugin for WordPress, specifically in versions 8.6.5 prior to 8.7.5. The issue arises from a missing capability check in the cwmpUpdateOptions() function, allowing unauthenticated attackers to arbitrarily modify WordPress options. This vulnerability can be exploited to change the default user role for new registrations to administrator, thereby granting administrative access to the attacker on the affected WordPress site.

Impact

Exploitation of this vulnerability allows for unauthorized users to gain administrative privileges on the WordPress site.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.