Official Integration for Billingo <= 4.3.2 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Options Update in Email Settings
- ID
- WPSEC-2026-0616
- Plugin
- Billingo Official for WooCommerce (billingo)
- Affected
- all versions before 4.3.3
- Remediation
- Update to 4.3.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-08
- Attack surface
- Official Integration for Billingo on WPSec AttackSurface
- Fix released
- Published
Description
The Billingo Official for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the email settings save handler in all versions up to, and including, 4.3.2 due to the plugin passing every key of the submitted 'billingo_email_settings' array directly to update_option() without restricting it to the plugin's own options. This makes it possible for authenticated attackers with Shop Manager-level access and above, who can save WooCommerce settings, to update arbitrary WordPress options, such as enabling user registration and setting the default role to administrator, to gain administrative access to the site.
References
- https://wpsec.com/vuln/WPSEC-2026-0616/
- https://plugins.svn.wordpress.org/billingo/tags/4.3.3/
- https://wordpress.org/plugins/billingo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS