CVE-2025-3906 is a missing authorization vulnerability (CWE-862) in the Integração entre Eduzz e Woocommerce plugin for WordPress. The issue arises because the 'wep_opcoes' function does not perform proper capability checks, enabling authenticated users with low privileges (Subscriber and above) to change the default user registration role to Administrator. This misconfiguration allows privilege escalation by creating Administrator accounts, compromising site integrity and control. The vulnerability affects all versions up to and including 1.7.5.

Successful exploitation permits an attacker with minimal authenticated access to escalate privileges by creating Administrator accounts. This can lead to full site compromise, including data modification, plugin/theme changes, and potential further attacks on the hosting environment. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and avoid granting Subscriber-level access to untrusted users. Restricting user registrations or disabling the plugin until a fix is released can reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.