A missing authorization check in the Anzar Ahmed Ni WooCommerce Cost Of Goods plugin allows an attacker to access or modify cost‑of‑goods settings that are normally restricted to privileged users. This flaw can lead to unauthorized changes in product pricing, affecting the integrity of sales data and potentially resulting in financial loss or inventory mismanagement. The weakness is classified as CWE‑862 (Missing Authorization).

WordPress sites that have installed the Ni WooCommerce Cost Of Goods plugin version 3.2.8 or earlier. The plugin is maintained by Anzar Ahmed and offers cost management features for WooCommerce stores.

The CVSS score of 5.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability has not been listed in the CISA KEV catalog. Based on the description, the likely attack vector is that an unauthenticated or minimally privileged user can interact with plugin endpoints that should require higher privileges, enabling them to modify cost data. No specific exploits have been reported, and no official patch or workaround is provided by the vendor at this time.