The vulnerability is an Insecure Direct Object Reference, where an attacker can manipulate user‑controlled keys to bypass access control in the Membership For WooCommerce plugin. This allows unauthorized access to membership or order data, potentially modifying status or viewing sensitive customer information. The weakness is classified as CWE‑639 – Authorization Bypass Through User‑Controlled Key.

WordPress installations that have the WP Swings Membership For WooCommerce plugin installed with any version up to and including 3.0.3 are exposed. Sites using older or newer versions are not affected; however, the exact version boundary is only documented as <= 3.0.3.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% suggests a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. The attack requires access to the web application and the ability to supply crafted requests to the plugin’s endpoints; the likely vector is a remote attacker sending manipulated requests to the WordPress admin area or exposed endpoints. Due to the misconfigured access control, even non‑privileged users can potentially retrieve or alter membership information.