The Woocommerce Multiple Addresses plugin for WordPress suffers from improper privilege management (CWE-269) in all versions up to 1.0.7.1. The vulnerability arises because the save_multiple_shipping_addresses() function does not adequately restrict which user meta fields can be updated by authenticated users. This flaw enables attackers with Subscriber-level privileges or higher to escalate their privileges to administrator level. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required privileges at the low level, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated user with Subscriber-level access or above to gain administrator privileges on the affected WordPress site. This can lead to full site compromise, including control over content, user accounts, and site configuration. The vulnerability affects all versions up to 1.0.7.1 of the Woocommerce Multiple Addresses plugin. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor the vendor's communications for updates. Until a fix is available, consider restricting plugin usage or limiting user roles that have access to this functionality to trusted users only.