User Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Arbitrary Options Update

The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.3.0. This is due to missing authorization checks on the save_tab_settings() function. This makes it possible for unauthenticated attackers to change otherwise restricted plugin options that can be used to inject new administrative user accounts.