Dyingman

An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can grant themselves any premium membership tier without completing a PayPal transaction. This allows the generation of a falsified active payment receipt and provides unauthorized access to restricted property listing allowances.

Authenticated users with Subscriber-level access and above can perform unauthorized modification, creation, and deletion of product specification groups and attributes. This occurs because the ` invoke()` methods within the `AttributeGroupController` and `AttributeController` classes lack capability checks and nonce verification. These methods are linked to the 'dwps modify groups' and 'dwps modify attributes' AJAX actions. Exploitation allows attackers to manipulate taxonomy terms in the `spec-group` and attribute taxonomies, which can corrupt business data and affect the frontend display of the site.