This vulnerability in Selling Commander for WooCommerce arises from incorrect privilege assignment, enabling an attacker to escalate privileges. It affects all versions up to 1.2.46. The CVSS 3.1 vector indicates the attack can be performed remotely with no privileges or user interaction required, resulting in high impact on confidentiality, integrity, and availability. No official patch or fix has been referenced in the available data.

Successful exploitation could allow an unauthenticated attacker to gain elevated privileges within the affected plugin environment, potentially compromising the confidentiality, integrity, and availability of the system using the Selling Commander for WooCommerce plugin. This could lead to unauthorized access and control over WooCommerce operations managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to privilege escalation attempts. Avoid deploying or using vulnerable versions in production environments if possible.