This vulnerability in WPFactory EAN for WooCommerce involves improper privilege management (CWE-269), which can allow an attacker with some level of access to escalate their privileges. The affected versions include all versions up to 4.8.9. The CVSS 3.1 score of 7.2 indicates a high severity issue with network attack vector, low attack complexity, requiring high privileges but no user interaction, and impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and it is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker with existing privileges to escalate their access rights, potentially leading to full compromise of the affected WooCommerce plugin environment. This can impact confidentiality, integrity, and availability of the system. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying the principle of least privilege to user roles and limiting access to trusted users may reduce risk.