The vulnerability arises from a missing authorization check in the Conversios Conversios.io WordPress plugin, allowing an attacker to bypass incorrect access control settings. Because of this flaw, a user with insufficient privileges could access or modify the plugin’s data and operations. This is an improper authorization weakness (CWE‑862). No remote code execution or data loss is described, but the impact is unauthorized data access or manipulation.

The affected product is the Conversios.io enhanced‑ecommerce‑for‑woocommerce‑store WordPress plugin, versions up through 7.2.3. All WordPress installations running any of those versions are vulnerable.

The CVSS score is 4.3, indicating a moderate impact. The EPSS score of < 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote if the plugin exposes administrative interfaces to users with insufficient privileges. While a public exploit has not been disclosed, the risk remains moderate but present.