# Official Integration for Billingo <= 4.3.2 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Options Update in Email Settings

- **ID:** WPSEC-2026-0616
- **Plugin:** Billingo Official for WooCommerce (`billingo`), https://wordpress.org/plugins/billingo/
- **Affected versions:** all versions before 4.3.3
- **Fixed in:** 4.3.3 (Update to 4.3.3 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/billingo
- **Fix released:** 2026-08-12
- **Published:** 2026-10-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0616/

## Description

The Billingo Official for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the email settings save handler in all versions up to, and including, 4.3.2 due to the plugin passing every key of the submitted 'billingo_email_settings' array directly to update_option() without restricting it to the plugin's own options. This makes it possible for authenticated attackers with Shop Manager-level access and above, who can save WooCommerce settings, to update arbitrary WordPress options, such as enabling user registration and setting the default role to administrator, to gain administrative access to the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-0616/
- https://plugins.svn.wordpress.org/billingo/tags/4.3.3/
- https://wordpress.org/plugins/billingo/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0616/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.