The vulnerability is a missing authorization flaw that permits users with insufficient privileges to alter the thank‑you page settings in the VillaTheme Thank You Page Customizer for WooCommerce plugin. Because the plugin lacks proper permission checks, an attacker who can access the configuration interface may modify or delete content that is normally restricted to administrators. This flaw does not provide arbitrary code execution or direct system compromise; its impact is confined to the plugin’s configuration domain.

VillaTheme Thank You Page Customizer for WooCommerce versions up to and including 1.1.8 are affected. Any WordPress site that has not upgraded beyond 1.1.8 and uses this plugin is vulnerable.

The CVSS score of 4.3 indicates a medium severity, and the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an authenticated user with privileges below administrator; if the plugin exposes endpoints publicly, an unauthenticated attacker could also exploit the lack of access control. The condition requires access to the plugin’s configuration interface or an endpoint that lacks proper authorization checks.