The vulnerability in tychesoftwares Custom Order Numbers for WooCommerce results from missing authorization checks that allow unauthorized users to exercise functions reserved for privileged roles. This broken access control flaw enables an attacker to manipulate or access order numbering features that should be restricted to administrators or trusted personnel. The weakness is identified as CWE‑862, where improper enforcement of access controls can compromise the confidentiality, integrity, or availability of the affected system.

WordPress sites running the Custom Order Numbers for WooCommerce plugin version 1.11.0 or earlier. The affected product is provided by the vendor tychesoftwares and the vulnerability covers all releases up to and including 1.11.0.

The CVSS score of 5.3 indicates medium severity. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote via web requests that target privileged plugin endpoints (e.g., AJAX or REST API calls). An attacker who can send crafted requests may bypass role checks and gain unauthorized control over order numbers.