PDF Invoices & Packing Slips for WooCommerce – Challan <= 3.7.88 - Authenticated (Shop Manager+) Privilege Escalation

Description

The PDF Invoices & Packing Slips for WooCommerce – Challan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.7.88. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for authenticated attackers, with shop manager-level access and above, to elevate their privileges beyond those intended for their role.