A missing authorization flaw in the Cecabank WooCommerce plugin permits users to invoke privileged functions without proper role checks. The incorrect access control configuration enables an attacker to perform actions that should be restricted, potentially leading to unauthorized data changes or exposure. The weakness is classified as Missing Authorization (CWE‑862).

WordPress installations running the Cecabank WooCommerce Plugin version 0.3.4 or earlier are affected. Any site that has this plugin installed at or below that version faces the risk described.

The CVSS score of 5.3 indicates moderate severity, while an EPSS less than 1% shows a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA KEV. Off‑the‑shelf exploit code is not known, but an attacker could craft HTTP requests to the plugin’s endpoints to bypass authorization checks, assuming the plugin is publicly accessible.