The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the adduserinwaitinglist() function registered on the wpajaxyithwcwtladduser action being missing both a capability check and a nonce verification, and using parsestr() + extract() to import attacker-controlled variables from $POST['params'] that are then passed to wpcreateuser() and $user->setrole(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator by creating a new user account and assigning it the administrator role.