The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress suffers from an authorization bypass that allows a user with subscriber-level access or higher to read sensitive data. By sending crafted requests to an exposed AJAX endpoint, an attacker can download user emails, usernames, roles, capabilities and WooCommerce information such as products and payment methods, violating confidentiality.

This issue affects the sundayfanz wModes plugin, versions up to and including v1.2.2, which is available for WordPress sites using WooCommerce. No specific operating system or WordPress version is listed; any installation running the affected plugin version is at risk.

The CVSS score of 4.3 indicates a moderate impact. The EPSS score is listed as < 1%, implying a low probability of exploitation in the general population, and the vulnerability is not present in the CISA KEV catalog. The likely attack vector is through an authenticated AJAX call, as the plugin fails to verify user permissions before returning sensitive data.