The vulnerability identified as a missing authorization flaw allows users to access functionality within the YayPricing plugin that should be restricted by access control lists. This broken access control can lead to exploitation of privileged features, potentially exposing sensitive data or allowing unprivileged users to manipulate pricing information. The weakness is classified as CWE-862, indicating that the plugin fails to enforce proper authorization checks.

WordPress sites running the YayCommerce YayPricing plug‑in version 3.5.3 or earlier are impacted. Users of older or pre‑3.5.3 releases are also included, as the issue is present from the earliest available versions through the highlighted threshold. The vulnerability affects any installation that has the plug‑in enabled and may expose additional functions via the web interface.

The CVSS score of 7.5 signals a high severity level, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting no large‑scale exploitation campaigns are currently known. Attackers would need to target a WordPress site hosting the affected plug‑in and discover the exposed endpoints, a scenario that is likely inferred rather than explicitly detailed in the available data. If successful, the attacker could harvest or alter pricing data, which may impact the confidentiality and integrity of the site’s commerce information.