This vulnerability, identified as CWE-266 (Incorrect Privilege Assignment), exists in the Affiliate Pro plugin for WooCommerce & WordPress up to version 8.9.1. It enables unauthenticated attackers to escalate their privileges, potentially gaining administrative access without authentication. The CVSS 3.1 score of 9.8 indicates a critical severity with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided by the vendor or in the advisory data.

Successful exploitation allows unauthenticated attackers to escalate privileges, potentially gaining administrative control over the WordPress site using the Affiliate Pro plugin. This can lead to complete compromise of the site, including data theft, modification, or destruction, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Consider disabling the plugin if possible to reduce risk.