CVE-2024-13343 is a privilege escalation vulnerability in the WooCommerce Customers Manager WordPress plugin caused by the absence of a capability check in the ajax_assign_new_roles() function. Authenticated users with low-level privileges (Subscriber and above) can exploit this to gain administrator rights. The vulnerability affects all versions up to 31.3. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the low level, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with authenticated Subscriber-level access or higher can escalate privileges to administrator, potentially gaining full control over the affected WordPress site. This can lead to complete compromise of site data, configuration, and functionality, impacting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious privilege changes. Consider disabling or removing the WooCommerce Customers Manager plugin if possible to reduce exposure.