The vulnerability is a missing authorization flaw that allows an attacker to access sensitive functions of the Nota Fiscal Eletrônica WooCommerce plugin. Incorrectly configured access control security levels let users perform operations that should be restricted to privileged administrators. The weakness aligns with CWE-862, an access control error, and can potentially enable unauthorized data disclosure or manipulation of electronic fiscal documents.

Affected users are those running the webmaniabr Nota Fiscal Eletrônica WooCommerce plugin at versions from the earliest available release up to and including 3.4.0.9, regardless of the operating environment. The issue is confined to the WordPress plugin and does not affect the core WordPress installation or other WordPress plugins.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely in the immediate term. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the most probable attack vector requires authenticated access to the plugin’s administrative interface; however, if the plugin is exposed to external traffic or misconfigured, remote exploitation becomes possible. No public exploit is documented, so the risk is currently limited to environments that have the vulnerable plugin version deployed and exposed.