The plugin contains a missing‑authorization flaw that allows an attacker to delete arbitrary content. The vulnerability is identified as CWE‑862, an Authorization weakness caused by incorrectly configured access controls. An attacker who can reach the plugin front‑end can trigger deletion requests without needing legitimate administrative privileges.

The affected product is the Bytes Technolab Add Product Frontend for WooCommerce WordPress plugin. All versions from the first release (n/a) through 1.0.8 are impacted; users who run any of those versions face the deletion flaw until they upgrade.

The CVSS score of 8.2 rates the flaw as high impact. The EPSS score is less than 1%, indicating a low exploitation probability as of now, and it is not listed in the CISA KEV catalog. The flaw can be exploited through the public front‑end of the site; it does not require authentication, so the attack vector is likely local or remote but does not rely on privileged accounts. Because the plugin exposes a deletion endpoint without checking user capabilities, any user who can access that endpoint can delete products.