WPFactory Wishlist for WooCommerce contains a missing authorization flaw that allows users to bypass the intended access control security settings. The vulnerability is tied to incorrectly configured access control levels, meaning users may be able to perform actions that are meant to be restricted. Because the weakness is categorized as CWE‑862, it denotes an improper enforcement of permission checks, leading to the potential for unauthorized use of the plugin’s capabilities.

Any WordPress site running the WPFactory Wishlist for WooCommerce plugin with a version up to and including 3.2.3 is affected; the exact lower bound is unspecified, so all versions marked as 'n/a through <= 3.2.3' are vulnerable. Site administrators should verify the plugin version and upgrade or patch if necessary.

The CVSS score of 6.5 places this issue in the medium severity range. The EPSS score is reported as less than 1%, indicating a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. The flaw resides in a web‑accessible plugin, so the attack vector is likely online and does not require local access. Although exploitation activity has not been observed at a high rate, the ability to bypass access controls warrants revisiting security settings promptly.