{
 "id": "WPSEC-2026-0616",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0616/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0616/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0616/index.md",
 "title": "Official Integration for Billingo <= 4.3.2 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Options Update in Email Settings",
 "description": "The Billingo Official for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the email settings save handler in all versions up to, and including, 4.3.2 due to the plugin passing every key of the submitted 'billingo_email_settings' array directly to update_option() without restricting it to the plugin's own options. This makes it possible for authenticated attackers with Shop Manager-level access and above, who can save WooCommerce settings, to update arbitrary WordPress options, such as enabling user registration and setting the default role to administrator, to gain administrative access to the site.",
 "plugin": {
  "slug": "billingo",
  "name": "Official Integration for Billingo",
  "full_name": "Billingo Official for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/billingo/",
  "advisories_url": "https://wpsec.com/vuln/plugin/billingo/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/billingo"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-269"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.3.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.3.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.3.3",
 "remediation": "Update to 4.3.3 or later.",
 "fix_released": "2026-08-12T06:23:57+00:00",
 "published": "2026-10-08T07:44:03+00:00",
 "updated": "2026-10-08T07:41:07.190540+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0616/",
  "https://plugins.svn.wordpress.org/billingo/tags/4.3.3/",
  "https://wordpress.org/plugins/billingo/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/billingo",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-08"
 }
}