The Eyewear prescription form plugin for WordPress suffers from a missing authorization check on the SubmitCatProductRequest AJAX action. Unauthenticated users can invoke this endpoint and create WooCommerce products with arbitrary names, prices, and categories by sending the 'Name', 'Price', and 'Parent' parameters. This flaw allows an attacker to add unauthorized products to the store, potentially leading to fraudulent listings, incorrect inventory, and financial loss.

All installations of the Eyewear prescription form plugin by Dugud Labs with version 6.0.1 or earlier are affected. The vulnerability exists regardless of the WordPress site’s configuration beyond the presence of the plugin and does not require any co‑existing vulnerabilities.

The CVSS base score is 5.3, indicating medium severity. The EPSS is below 1%, suggesting a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker would simply need to send an unauthenticated HTTP request to the plugin's AJAX endpoint, so the attack vector is effectively the public web interface. The lack of authentication checks and the fact that the action performs write operations provide the necessary conditions for successful exploitation.