Missing authorization in the PW WooCommerce On Sale! plugin can let an attacker perform administrative actions such as modifying sale rules or accessing protected content. The flaw is a classic missing‑capability check, giving the attacker the same privileges as a legitimate administrator. This elevates the risk to confidentiality, integrity, and availability of the e‑commerce site.

The vulnerability affects the WordPress plugin PW WooCommerce On Sale! from the vendor pimwick, covering all releases up to and including version 1.39.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score is less than 1 %, suggesting a low likelihood of widespread exploitation at present, and it is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation of the plugin through HTTP requests to exposed administrative endpoints or via the plugin’s admin settings interface, assuming the attacker has a valid user account or can obtain administrative credentials. Based on the description, it is inferred that the plugin lacks proper access checks before performing privileged operations.