A missing authorization check in the WordPress plugin Open Close WooCommerce Store allows an attacker to bypass intended access restrictions. The flaw can enable the manipulation of store operation settings and potentially other privileged operations, threatening the integrity of store configuration and the availability of sales functions. The weakness is classified as CWE‑862, indicating improper enforcement of authorization policies.

The affected product is the Open Close WooCommerce Store plugin from StackWC. All releases up to and including version 5.0.0 are vulnerable; the issue is noted as affecting the plugin set from unspecified initial release through v5.0.0.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1 % shows a very low likelihood of active exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, requiring either authenticated access with insufficient privilege or discovery of a misconfigured access control level; no exploitation details are explicitly documented in the CVE.