Access violation vulnerability in MultiLoca – WooCommerce Multi Locations Inventory Management 4.2.8

A plugin called MultiLoca, used for managing inventory on WordPress websites, has a security flaw that allows unauthorized users to change important data. This could lead to them gaining more privileges and control over the website. The flaw is caused by a missing security check in the ‘wcmlim_settings_ajax_handler’ function, present in all versions up to 4.2.8. This means that attackers who are not logged in can make changes to various settings on the website. They could potentially change the default role for new users to administrator, giving them access to the site as an admin. This could be used to take control of a vulnerable website.