Missing Authorization in Bizswoop Account Manager for WooCommerce allows attackers to access or modify data that should be restricted to privileged users. The flaw is a classic access control weakness, exposing sensitive account information and potentially allowing unauthorized control of user accounts. This flaw could lead to data theft, defacement, or further compromise within the WordPress site.

The vulnerability impacts the WordPress plugin "Account Manager for WooCommerce" from any version up to and including 2.1.2. The plugin is supplied by Bizswoop and integrated into WooCommerce installations where it manages user accounts and orders.

The CVSS score of 4.3 indicates a moderate severity. EPSS is not available, and the issue is not yet listed in CISA’s KEV, suggesting it has not yet been widely exploited. The likely attack path requires an authenticated user, as the flaw is a missing authorization check; a user with standard privileges could manipulate the plugin’s endpoints to gain elevated permissions. This inference is drawn from the description, no explicit vector is stated.