The vulnerability is a missing authorization flaw that lets users access functionality in the WooCommerce Loyal Customers plugin that should be restricted by access control lists. Because the plugin does not properly check user permissions, an attacker could use the exposed features to bypass normal role restrictions and potentially retrieve or manipulate sensitive customer loyalty data. This flaw directly compromises confidentiality and integrity of the system’s loyalty information.

The Right Software’s WooCommerce Loyal Customers plugin is affected for all releases up through version 2.6. The flaw exists on WordPress installations that have the plugin active, regardless of the specific WordPress theme or additional plugins in use.

The CVSS score of 7.5 indicates a high severity risk, but the EPSS score of less than 1% suggests that at the time of this analysis exploitation is unlikely to be widespread. The plugin is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. It is inferred that the attack vector likely involves any authenticated user—potentially even one with a low‑privileged role—who can interact with the plugin’s API or admin UI, and that an attacker could exploit the issue without requiring other vulnerabilities to be present.