The Botiga Pro WordPress plugin contains a critical authorization flaw that allows unauthenticated attackers to achieve full site takeover through arbitrary option modification and cross-site scripting.

This vulnerability is a missing authorization flaw (CWE-862) within the plugin REST API. Unauthenticated attackers can interact with specific endpoints to update site configuration options, inject arbitrary scripts, or delete content, effectively bypassing all authentication requirements.

The ability to modify arbitrary WordPress options allows an attacker to elevate their privileges to administrator, leading to a complete compromise of the web application. Furthermore, the stored cross-site scripting vulnerability poses a significant risk to site visitors and administrators, potentially leading to session hijacking or the distribution of malicious content, resulting in severe reputational and operational damage. Given the critical CVSS score of 9.8, this vulnerability represents an immediate and high-risk threat to business continuity.

Immediate Action: Update the Botiga Pro plugin to version 1.6.5 or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Review web server access logs for anomalous requests targeting REST API routes, particularly those originating from unknown or suspicious IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block unauthorized requests to the plugin REST endpoints until the software can be patched.

Public Exploit Available: No

This vulnerability presents a severe risk to any organization utilizing the Botiga Pro plugin. Due to the potential for total site takeover and the ease of exploitation, administrators must prioritize updating to version 1.6.5 immediately. Failure to patch will leave the application exposed to trivial unauthorized configuration changes and malicious script injection.