The vulnerability identified as CVE-2025-60222 affects the SUMO Memberships for WooCommerce plugin by FantasticPlugins. It involves incorrect privilege assignment that can lead to privilege escalation. The affected versions include all versions up to 7.8.0. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability can be exploited remotely over the network with low complexity and does not require user interaction. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor or in the advisory.

Successful exploitation of this vulnerability could allow an attacker with some level of access to escalate their privileges, potentially leading to full compromise of the affected WooCommerce membership system. This could result in unauthorized access to membership data, modification of membership privileges, and disruption of service availability. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. Applying principle of least privilege and restricting access to trusted users may reduce risk. No official patch or temporary fix is currently documented.