A missing authorization check in the Orders Chat for WooCommerce plugin enables users with insufficient rights to access and interact with order chat endpoints, potentially exposing sensitive order data and allowing manipulation of messages. The vulnerability is a classic broken access control flaw (CWE‑862) and could be leveraged to read or alter private conversations between merchants and customers.

The affected product is the Orders Chat for WooCommerce plugin developed by Mykola Lukin. All releases through version 1.2.0 are impacted; any deployment using these or earlier versions is vulnerable.

The CVSS score of 4.3 indicates a moderate severity. EPSS is reported as < 1 %, suggesting a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal, requiring an authenticated WordPress user with a role that can interact with the plugin. The attacker could gain unauthorized access to the chat API and potentially read or inject messages between merchants and customers.