Furthermore, the function insecurely utilizes parse_str() and extract() to process variables from the $_POST['params'] array. An authenticated attacker, such as a subscriber, can supply maliciously crafted input to this endpoint, allowing them to manipulate the wp_create_user() and $user->set_role() calls. By injecting specific parameters, the attacker can force the application to create a new user account with administrative privileges, granting them full control over the compromised WordPress installation.

Impact

Successful exploitation allows any authenticated user (e.g., a subscriber) to gain full administrative access to the WordPress site. This leads to complete site takeover, potential data exfiltration of customer information, unauthorized modification of site content, and potential persistent backdoor installation.

Recommendation

1. Patch immediately by upgrading the YITH WooCommerce Waitlist Premium plugin to version 3.35.1 or later.
2. Audit current WordPress administrative users for accounts created via the wp_ajax_yith_wcwtl_add_user endpoint to identify potential past compromise.
3. Deploy the web application firewall (WAF) rule to block POST requests to the vulnerable AJAX action that contain suspicious parameter payloads attempting to set user roles.