A missing authorization flaw in the Conversios.io enhanced‑e‑commerce‑for‑woocommerce‑store plugin permits exploitation of incorrectly configured access controls. The vulnerability enables an attacker with suitable HTTP access to obtain permissions beyond those intended, potentially allowing unauthorized configuration changes, data extraction, or other privileged actions within the WordPress site. The weakness is classified as CWE‑862, indicating a violation of access control policies.

WordPress sites using the Conversios Conversios.io enhanced‑e‑commerce‑for‑woocommerce‑store plugin with versions up to and including 7.2.13 are affected. No specific sub‑versions are listed beyond the upper bound of 7.2.13.

The CVSS score of 5.4 points to a moderate risk. The EPSS score is less than 1 %, indicating that widespread exploitation is unlikely at present, and the issue is not presently listed in CISA’s KEV catalog. However, if a site is running the vulnerable plugin and the access controls are misconfigured, an attacker could exploit the weakness locally or remotely via web requests to the plugin’s endpoints. Because the flaw originates from a missing authorization check, any user who can send crafted requests to the plugin’s URLs — whether through authenticated sessions or unauthenticated access paths that the plugin exposes — could potentially elevate privileges or manipulate e‑commerce settings.