Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce allows attackers to bypass access controls and use the plugin’s functionality without the proper permissions. This flaw is classified as CWE‑862, meaning that the application fails to enforce sufficient authorization checks. An attacker who exploits this weakness could perform actions that should be restricted to privileged users, such as modifying, deleting, or creating product variations that could affect inventory, pricing, and customer experience.

The vulnerability affects the WordPress plugin Advanced Linked Variations for Woocommerce released by Dotstore, in all versions up to and including 1.0.3. Users running these versions on any WordPress installation may be impacted.

The CVSS score of 5.3 indicates a medium level of severity. The EPSS score of less than 1% suggests that, while exploitation is possible, the current likelihood of attack is low. The vulnerability is not listed in CISA’s KEV catalog, meaning no publicly disclosed exploits are known. Based on the description, it is inferred that the threat would likely arise from remote submission of the plugin’s configuration or management interfaces, allowing unauthenticated or low‑privilege users to manipulate product data.