The extendons WooCommerce Registration Fields Plugin - Custom Signup Fields up to version 3.2.3 contains an incorrect privilege assignment vulnerability that enables privilege escalation. This means that users with limited privileges might be able to gain higher privileges than intended, potentially leading to full control over the affected WordPress environment. The CVSS v3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with some privileges to escalate their privileges, resulting in full compromise of the affected system's confidentiality, integrity, and availability. This could lead to unauthorized access, modification, or disruption of the WooCommerce environment using the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, consider restricting access to the plugin's functionality to trusted administrators only and monitor for suspicious activity related to privilege escalation attempts.