A critical privilege escalation vulnerability in the YITH WooCommerce Waitlist Premium plugin allows authenticated attackers to elevate their access to administrator status.

This vulnerability occurs because the add_user_in_waiting_list function lacks proper capability and nonce verification, allowing authenticated attackers with subscriber-level access to inject arbitrary parameters. These parameters are processed via parse_str and extract, enabling the attacker to manipulate user creation and role assignment functions to grant themselves administrative privileges.

Successful exploitation allows an authenticated attacker to gain full administrative control over the affected WordPress installation. This could result in complete data compromise, unauthorized modification of site content, installation of malicious backdoors, and potential loss of site availability. Given the CVSS score of 8.8, this vulnerability represents a high-severity threat to business operations and data integrity.

Immediate Action: Update the YITH WooCommerce Waitlist Premium plugin to version 3.36.0 or higher immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review WordPress user account logs for suspicious account creation events or unexpected changes to user roles, particularly those occurring via the admin-ajax.php interface.

Compensating Controls: If an immediate update is not feasible, implement Web Application Firewall (WAF) rules to filter and block requests directed at the wp_ajax_yith_wcwtl_add_user action that contain unauthorized user creation parameters.

Public Exploit Available: Unknown

The risk posed by this privilege escalation flaw is significant, as it provides a direct path for attackers to seize control of the application. Organizations must prioritize updating the YITH WooCommerce Waitlist Premium plugin to version 3.36.0 as soon as possible to neutralize this vulnerability. Failure to patch may expose the entire WordPress environment to full administrative compromise.