WCFM Membership – WooCommerce Memberships for Multivendor Marketplace < 2.12.0 - Authenticated (Subscriber+) Privilege Escalation

Description

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.11.11. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges beyond those intended for their role.