The vulnerability is a missing authorization flaw in the Simple Sticky Add To Cart For WooCommerce WordPress plugin. Because the plugin’s access control logic is incorrectly configured, an unauthenticated or improperly authenticated user could manipulate cart actions or trigger privileged functionalities that should be restricted to authorized users. This Weakness aligns with CWE-862 – Missing Authorization. The potential impact is the unauthorized modification of cart contents or other privileged e‑commerce actions within a WordPress site.

WordPress sites that deploy the Simple Sticky Add To Cart For WooCommerce plugin version 1.4.9 or earlier are affected. The vendor listed is Sharaz Shahid. No specific CPE identifiers are provided, but the flaw applies to every installation of the plugin at the indicated or lower versions.

The CVSS score of 4.3 indicates moderate potential for exploitation, while the EPSS score of less than 1% suggests a very low probability of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local or remote attacker who can reach the WordPress admin interface or who can exploit the plugin’s exposed endpoints without proper authorization checks. Precise exploitation steps are not detailed in the CVE, but the missing authorization check would allow an attacker to perform privileged cart actions that should be restricted.