The issue is a Missing Authorization vulnerability that allows an attacker to modify the Addonify – Compare Products For WooCommerce plugin settings. Without proper capability checks, any authenticated user with access to the WordPress admin area could change configuration options, potentially altering product comparison behavior, exposing data or disrupting store operations. This flaw is a classic CWE‑862 case of missing authorization and can facilitate privilege escalation within the WordPress site.

Addonify – Compare Products For WooCommerce plugin, versions from unknown release onwards up to and including 1.1.17, is impacted.

The CVSS score of 6.5 indicates a medium severity vulnerability, while the EPSS score of <1% suggests a very low probability of exploitation in the wild and it is not listed in CISA KEV. The likely attack vector is via the WordPress administrative interface; an attacker with a known user account that can reach the plugin’s settings page could exploit the missing authorization to change settings. In the absence of additional hardening, an attacker could elevate privileges or create a foothold for further compromise.