CVE-2025-9054 is a critical missing authorization vulnerability (CWE-862) in the MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress. The vulnerability arises from the lack of capability checks in the 'wcmlim_settings_ajax_handler' function, allowing unauthenticated users to update arbitrary options on the WordPress site. This can be exploited to escalate privileges by setting the default registration role to administrator and enabling user registration, thereby granting attackers administrative control over the site. The vulnerability affects all versions up to and including 4.2.8 and has a CVSS 3.1 base score of 9.8, indicating critical severity.

Successful exploitation allows unauthenticated attackers to modify site options, including changing the default user role to administrator and enabling user registration. This leads to privilege escalation and full administrative access to the WordPress site, compromising confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin's AJAX handlers if possible and monitor for suspicious activity related to user role changes or registration settings. Avoid enabling user registration or changing default roles to administrator as a temporary precaution.