GS Plugins' GS Variation Swatches for WooCommerce plugin suffers from a missing authorization flaw, allowing users to exploit incorrectly configured access control levels. The vulnerability is a classic example of CWE‑862, where purpose‑built security checks are omitted, enabling unauthorized users to manipulate plugin settings or data. Consequently, attackers may gain privileges beyond their intended scope, potentially altering product variations or other shop configurations.

Any WordPress installation running GS Variation Swatches for WooCommerce, versions from the earliest release through 3.0.4, is affected. The flaw remains present in all releases up to and including 3.0.4.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, via the WordPress site's front‑end or admin area, and requires a user role that can interact with the plugin’s UI or API endpoints. Successful exploitation would grant the attacker unauthorized changes to product swatches or other shop settings, depending on the misconfigured privileges.