WP Swings Membership For WooCommerce contains a missing authorization flaw that allows an attacker to perform actions that are not properly protected by access control lists. The vulnerability is an improper privilege assignment (CWE‑862) and can expose or modify sensitive configuration or management operations without requiring the proper permissions, thereby risking confidentiality, integrity, or availability of site data.

All releases of the WP Swings Membership For WooCommerce plugin from the initial version through 2.9.0 are affected, as the flaw exists in every version up to and including 2.9.0.

The CVSS score of 7.5 indicates a high impact if exploited, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker exploiting the plugin’s administrative interfaces, either by using valid site credentials or, if the plugin’s endpoints are exposed, by unauthenticated access. The flaw permits bypassing normal role checks, allowing privileged operations to be performed by unauthorized users.