The vulnerability resides in the Make Email Customizer for WooCommerce plugin through version 1.0.6, where callback functions handling AJAX requests lack checks that confirm the caller is authorized to perform configuration changes. An authenticated user with the Subscriber role can therefore invoke these endpoints and submit arbitrary option names and values, overriding default WordPress settings. This allows the attacker to alter site behavior, potentially modify URLs, feature flags, or logging settings, which could degrade site integrity or expose further attack vectors.

The affected product is the Make Email Customizer for WooCommerce plugin installed on WordPress sites. Versions through 1.0.6 are vulnerable. Any site that has installed this plugin and grants normal Subscriber roles to users is at risk, even if the attacker does not have administrative privileges.

The CVSS score of 5.3 indicates a moderate impact, with the EPSS score listed as < 1% suggesting a very low probability of exploitation in the wild. The vulnerability is not currently recorded in CISA's KEV catalog. The attack vector requires the attacker to be authenticated; therefore, a legitimate user with Subscriber privileges can send a crafted AJAX request to alter options. Because the plugin permits arbitrary option updates, the attacker could potentially impact configuration settings that influence overall site functionality or security.