The vulnerability is a missing authorization flaw in the Dotstore Hide Shipping Method For WooCommerce plugin that allows users without proper privileges to access shipping methods that are meant to be hidden. This can lead to disclosure or tampering of shipping options for customers, potentially undermining the intended business logic. The weakness corresponds to CWE-862.

Dotstore Hide Shipping Method For WooCommerce plugin for WordPress, versions up to and including 1.5.1 are affected.

Severity is rated CVSS 4.3, indicating moderate impact. The EPSS score is less than 1%, implying a low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to exploit the WordPress/WooCommerce environment, likely gaining access through the admin interface or by interacting with the plugin’s exposed endpoints; the exact path is not detailed in the advisory, so we infer it is a web-based vector. Given the mild score and low exploit likelihood, the risk to a system is considered moderate but treatment is still recommended.