This vulnerability arises from a missing capability check in the RemoveItems AJAX action of the Eyewear prescription form plugin. Because the plugin fails to verify user permissions, any unauthenticated user can submit a request with the 'catIds' parameter and delete arbitrary WooCommerce product categories, including all of their child categories. The underlying weakness is a classic missing authorization flaw, classified as CWE-862.

WordPress sites that have installed the Dugudlabs Eyewear prescription form plugin, versions up to and including 6.0.1. The flaw specifically targets environments that also run WooCommerce, since the deletion payload directly manipulates WooCommerce product categories. No specific patch version is listed in the data, but the issue applies universally to all versions up to 6.0.1.

The CVSS score of 5.3 indicates a moderate impact when the flaw is exploited, while the EPSS score of less than 1% suggests a very low probability of exploitation at the time of this analysis. The vulnerability is not currently listed in the CISA KEV catalog, which reduces the likelihood of a widespread public exploit. Nonetheless, the attack vector is straightforward: an unauthenticated HTTP request to the RemoveItems AJAX endpoint with a crafted 'catIds' argument. An attacker only needs access to the WordPress site and no privileged credentials to delete product categories.