Technical impact
The Perfit WooCommerce plugin contains a missing authorization check on the logout function that is invoked via an admin_init hook. This flaw allows an attacker, without authentication, to provide an action parameter that triggers the deletion of any plugin setting. The vulnerability is classified as CWE‑862 and can result in loss of e‑commerce configuration, potentially disabling store features, disrupting checkout workflows, or enabling further malicious actions.
Affected Systems
All installations of the Perfit WooCommerce plugin released by perfitdev, up through version 1.0.1, are affected. The issue resides in the code managing the settings tab and impacts any site running these versions.
Risk and Exploitability
The CVSS score of 5.3 places the flaw in the moderate severity range, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely remote via HTTP requests to the WordPress admin interface; this inference is based on the described missing authorization on the admin_init hook and the lack of authentication requirements.
