The Wilson OpenAI Tools for WordPress & WooCommerce plugin contains a missing authorization flaw that stems from incorrectly configured security levels, making it a CWE‑862 Broken Access Control issue. An attacker who is authenticated to the WordPress site can perform actions in the plugin that are outside the scope of the user’s role, effectively allowing unauthorized use of the plugin’s features. The vulnerability does not grant remote code execution or elevate privileges beyond the currently authenticated level.

All releases of the Wilson OpenAI Tools for WordPress & WooCommerce plugin up to and including version 2.2.1 are impacted; no lower bound is specified. The flaw affects any WordPress installation where the plugin is installed and enabled, regardless of the site’s overall configuration or role assignments.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% shows a low probability of exploitation, and the flaw is not present in the CISA KEV catalog. The likely attack vector is through the plugin’s web endpoints or administrative interface, requiring an authenticated user. Exploitation is limited to operations within the plugin and cannot be leveraged for broader system compromise beyond the user’s existing permissions.