The vulnerability arises from missing authorization in the WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin, allowing attackers to bypass intended access controls. This flaw is identified as a CWE-862 missing authorization weakness, and it can enable an attacker to interact with administrative settings or cart customization features without the appropriate user privileges. The potential impact is the unauthorized modification of cart behavior and checkout fields, which could affect order processing and customer data integrity.

The affected system is the WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin, distributed by cscode. All versions from the earliest release through 1.2.4.5 are impacted. No other vendor or product is listed.

The CVSS base score is 5.4, indicating medium severity, and the EPSS score is below 1%, suggesting a low probability of exploitation in the general population. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector involves accessing plugin configuration or cart-related interfaces that are normally restricted to privileged users, and the attacker would need access to the site interface or API where the plugin functionality is exposed.