The Breeze Checkout plugin for WordPress suffers from a missing authorization flaw that allows attackers to bypass configured access control security levels. Because the plugin does not enforce proper authorization checks, malicious users can perform actions beyond their granted roles, such as accessing protected options or executing privileged operations. The weakness is classified as CWE‑862, making unauthorized access to resources controlled by the plugin possible.

All installations of Breeze Checkout versions up to and including 1.4.0 are affected. The vulnerability applies to Breeze Team's Breeze Checkout plugin for WordPress; no information indicates a patch release of the plugin at this time.

The CVSS score of 6.5 reflects moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely involve web requests to the plugin’s endpoints and does not require special privileges beyond the ability to interact with the affected WordPress site, potentially making it available to any authenticated or unauthenticated user depending on plugin configuration.