The vulnerability arises from an authorization flaw that permits users without the necessary permissions to invoke privileged functions within the Membership For WooCommerce plugin. An attacker who can trigger these functions can potentially modify membership settings or gain additional administrative capabilities, thereby compromising the confidentiality and integrity of the site’s membership data.

WordPress sites running the WP Swings Membership For WooCommerce plugin version 2.8.1 or earlier are impacted. The issue is present from the earliest released version up through 2.8.1. No other versions are affected according to the data provided.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of <1% suggests a low probability of exploitation at this time. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web‑based approach, where an attacker could access restricted plugin endpoints without proper authorization, potentially allowing unauthorized modification of membership data.