A high-severity privilege escalation vulnerability in Webkul Bagisto 2.4.9 allows low-privileged administrative users to gain full system control, posing a significant risk to data and infrastructure integrity.

This is a privilege escalation flaw located in the admin.settings.users.update endpoint. The vulnerability occurs because the application fails to perform authorization checks when assigning roles, allowing an authenticated user with limited permissions to promote their own account to the Administrator role.

Successful exploitation of this flaw grants an attacker full administrative access to the Bagisto backend. This results in complete compromise of system functionality, including the ability to modify store configurations, access sensitive payment gateway credentials, and exfiltrate customer personally identifiable information (PII). Given the CVSS score of 8.8, this vulnerability represents a high risk that could lead to severe operational disruption and regulatory non-compliance.

Immediate Action: Contact Webkul support or monitor the official Bagisto repository for the release of a security patch addressing this privilege escalation vulnerability in version 2.4.9.

Proactive Monitoring: Review administrative audit logs for unusual user role modifications, specifically looking for accounts that have self-promoted or were updated by low-privileged users.

Compensating Controls: Restrict access to the administrative backend to trusted IP ranges via a Web Application Firewall (WAF) or VPN to limit the attack surface for existing authenticated users.

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's published technical write-up on GitHub.

Organizations utilizing Webkul Bagisto 2.4.9 must prioritize the mitigation of this vulnerability. Since an authenticated attacker can trivially gain full administrative control, administrators should immediately review current user permissions and restrict access to the user-management module until a vendor-supplied patch is applied.