The vulnerability is a missing authorization check in StackWC Order Listener for WooCommerce (woc-order-alert) versions up to 3.6.1. Because the plugin does not enforce proper access control, any authenticated or potentially unauthenticated user can invoke privileged plugin functionality that should be restricted. The weakness aligns with CWE‑862, representing an access control failure that can lead to unauthorized manipulation of order alerts or other sensitive operations.

The affected product is the StackWC Order Listener for WooCommerce plugin, with all releases from the unknown initial version up through 3.6.1 susceptible to this flaw.

The CVSS score of 9.4 indicates a critical impact on confidentiality, integrity, and availability. The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is via the web interface, where an attacker can craft requests to unprotected plugin endpoints to gain unauthorized access or alter order alert behavior. No special conditions are required beyond the plugin’s presence and reachable endpoints.