The vulnerability is a cross‑site request forgery that arises from missing authorization checks in the Taxonomy/Term and Role based Discounts for WooCommerce plugin. By exploiting this flaw, an attacker who can cause a logged‑in user to submit a crafted request can alter discount configuration settings, potentially leading to unintended discounts or the removal of existing ones. The weakness is classified as CWE‑862 and can directly compromise the financial integrity of the WooCommerce store.

The issue affects the WordPress plugin developed by Marco Almeida | Webdados, named Taxonomy/Term and Role based Discounts for WooCommerce. All versions from the initial release up to and including 5.1 are impacted.

The CVSS score is 4.3, indicating moderate impact. The EPSS score is less than 1 %, showing low current exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector is a CSRF where an authenticated user is tricked into sending an unauthorized request to the plugin’s settings endpoint. No public exploit is known, but the flaw permits unauthorized configuration changes that could affect store revenue and customer experience.