The YITH WooCommerce Waitlist Premium plugin for WordPress versions up to and including 3.35.0 contains a privilege escalation vulnerability (CWE-269). The add_user_in_waiting_list() function, triggered via the wp_ajax_yith_wcwtl_add_user action, does not perform capability checks or nonce verification. It uses parse_str() and extract() on attacker-controlled $_POST['params'], which are then passed to wp_create_user() and $user->set_role(). This flaw enables authenticated attackers with Subscriber-level privileges or above to create new user accounts and assign them administrator roles, effectively escalating their privileges.

An authenticated attacker with Subscriber-level access or higher can exploit this vulnerability to create new user accounts with administrator privileges. This leads to full administrative control over the affected WordPress site, including the ability to modify site content, install plugins, and manage users, resulting in complete compromise of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and consider disabling or removing the YITH WooCommerce Waitlist Premium plugin if possible. Monitor for updates from the vendor and apply patches promptly once released.