WordPress Plugin Vulnerabilities

Official Integration for Billingo <= 4.3.3 - Shop Manager+ Privilege Escalation

Description

The Official Integration for Billingo plugin for WordPress is vulnerable to Privilege Escalation. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to gain administrative-level user access.

Affects Plugins

Plugin icon
billingo
No known fix

References

CVE
CVE-2025-49950
URL
https://vdp.patchstack.com/database/Wordpress/Plugin/billingo/vulnerability/wordpress-official-integration-for-billingo-plugin-4-2-5-privilege-escalation-vulnerability

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Martino Spagnuolo
Verified
No
WPVDB ID
97c67f9e-18e0-486d-82a3-ae54f331d4a2

Timeline

Publicly Published
2025-07-10 (about 1 year ago)
Added
2025-12-11 (about 9 months ago)
Last Updated
2026-07-09 (about 2 months ago)

Other

Published
Title
Published
2025-03-06
Title
InWave Jobs <= 3.5.1 - Unauthenticated Privilege Escalation
Published
2026-09-08
Title
YITH WooCommerce Waitlist Premium < 3.36.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user
Published
2026-02-18
Title
Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation
Published
2026-03-04
Title
Amelia < 2.0 - Employee+ Privilege Escalation
Published
2026-04-08
Title
WP BASE Booking of Appointments, Services and Events < 6.0.0 - Unauthenticated Privilege Escalation