The EasyCommerce WordPress plugin contains a privilege escalation vulnerability (CWE-269) due to insufficient access control on the /easycommerce/v1/orders REST API endpoint. This endpoint improperly allows unauthenticated users to specify roles during registration, enabling attackers to escalate privileges to administrator level. The vulnerability affects versions 0.9.0-beta2 through 1.8.2. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can exploit this vulnerability to gain administrator privileges on a vulnerable WordPress site running the EasyCommerce plugin. This level of access allows full control over the site, including the ability to modify content, install malicious code, and compromise site integrity and availability. The vulnerability is critical due to the ease of exploitation and the high impact on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API endpoints if possible, and monitor for suspicious registration activity. Avoid using affected versions of the EasyCommerce plugin in production environments. Follow vendor channels closely for updates and apply patches promptly once available.