The flaw is a missing authorization check that allows an attacker to arbitrarily update plugin options, effectively giving them elevated privileges within WordPress. This change can grant the attacker additional access or modify the store’s behavior.

WordPress users running the WPC Smart Upsell Funnel for WooCommerce plugin version 3.0.4 or earlier are vulnerable. The issue was discovered in the WPClever implementation of this plugin and affects all installations using any of the affected releases.

With a CVSS score of 8.8, the vulnerability poses high risk, though the EPSS score of less than 1% indicates low probability of current exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no large-scale exploitation has been documented. Attack vectors are inferred to be through the WordPress admin interface, as the lack of authorization allows unauthorized users to modify plugin options.