This vulnerability arises from missing authorization checks in the Saiful Islam Sync Master Sheet – Product Sync with Google Sheet for WooCommerce plugin. An attacker with access to the affected WordPress site can craft requests to privileged plugin endpoints and modify or inject product data that is synchronized to Google Sheets. The flaw, identified as CWE-862, would allow malicious actors to alter product listings, potentially leading to inventory inaccuracies, revenue loss, or disclosure of sensitive information to unintended recipients.

Any WordPress installation running the Sync Master Sheet plugin version 1.1.3 or earlier is affected. This includes sites that have configured the plugin to interact with external Google Sheets for product synchronization.

The CVSS score of 7.5 and an EPSS score of less than 1% indicate a high severity but a currently low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors involve authenticated WordPress users who inadvertently gain elevated privileges or attackers who can send crafted HTTP requests to the plugin’s API endpoints. Once exploited, the attacker can read, modify, or delete product data that is reflected in the linked Google Sheets.