The Order Notification for WooCommerce plugin before version 3.6.3 alters WooCommerce’s built‑in permission checks, allowing attackers to use the REST API without any credentials. This flaw grants complete read and write access to store resources such as products, coupons, and customer data, effectively giving an unauthenticated user full administrative control over the e‑commerce site.

All installations of the Order Notification for WooCommerce WordPress plugin with versions earlier than 3.6.3 are affected. Site owners running these legacy plugin versions rely on the plugin’s notification features, which in turn replace WooCommerce’s default permission logic for REST endpoints.

The CVSS score of 9.1 classifies this as a critical vulnerability, but its EPSS score of less than 1% indicates a low current exploitation likelihood. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability by issuing unauthenticated REST requests to endpoints such as /wp-json/wc/v3/products or /wp-json/wc/v3/customers, achieving full CRUD capability on the store.