MultiLoca WooCommerce Multi Locations Inventory Management Missing Authorization Vulnerability Privilege Escalation

A vulnerability in the MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress, present in versions through 4.2.8, allows for unauthorized data modification that could lead to privilege escalation. The issue arises from a missing capability check in the 'wcmlim_settings_ajax_handler' function, enabling unauthenticated attackers to update arbitrary options on the WordPress site. This vulnerability could be exploited to change the default role for new user registrations to administrator, thereby granting administrative access to the attacker.

Impact

Exploitation of this vulnerability could result in unauthorized administrative access on the affected WordPress site.

Remediation

Users are advised to update the plugin to version 4.2.9 or a newer patched version.