The vulnerability is a missing authorization flaw that allows a user without proper privileges to access or modify protected functionality within the Calculate Prices based on Distance For WooCommerce plugin. This broken access control can enable an attacker to manipulate distance settings or pricing logic, potentially affecting revenue or inventory calculations. The flaw is mapped to CWE-862, a weakness in controlling access to resources, and the CVSS score of 5.4 indicates a moderate severity.

Vulnerable systems are WordPress installations that have the ammarahmad786 Calculate Prices based on Distance For WooCommerce plugin installed in any version up to and including 1.3.5. All such deployments are affected, regardless of site size or business role, because the control is baked into the plugin core.

The likely attack vector is sending crafted HTTP requests to the plugin’s backend endpoints without requiring prior authentication. Based on the description, it is inferred that the attacker does not need any prior authentication to exploit this issue. The CVSS score of 5.4 reflects a medium impact, while the EPSS score of less than 1% suggests a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the lack of access checks could allow unauthorized users to manipulate pricing data, warranting proactive mitigation.