The vulnerability arises from missing authorization checks, allowing users without proper permissions to access data that the plugin handles. The primary impact is the exposure of sensitive information, such as customer details or order data, which could lead to privacy violations and financial loss. This weakness is identified as CWE-862, missing authorization.

The Arshid WooCommerce Quick View plugin, all versions up to 1.1.1, is affected. Systems running this plugin on WordPress sites are at risk when they have the plugin installed and enabled.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker would typically exploit the flaw by sending unauthenticated requests to the plugin's endpoints that bypass the intended access controls, assuming the plugin is active and web-accessible. Because no privilege escalation or code execution is required, the attack can be carried out from a web browser or a script.