The vulnerability is a missing authorization flaw in the Product Loops for WooCommerce plugin that allows attackers to exploit incorrectly configured access control security levels. An attacker can gain unauthorized access to features or data that should be restricted, potentially exposing sensitive configuration settings or transaction data. The weakness is classified as CWE‑862, indicating an absence of proper authorization checks.

Vendor XforWooCommerce’s Product Loops for WooCommerce plugin versions from n/a through 2.1.2 are affected. The issue is present in all releases ≤ 2.1.2 and does not apply to versions above that threshold.

The CVSS score of 5.3 indicates a moderate severity, but the EPSS score of < 1% shows that exploitation is unlikely at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is likely a web‑based request to a plugin endpoint that skips authorization checks. An attacker would need access to the site’s URLs and may benefit from authentication with a user role that has sufficient privileges to interact with the plugin, but the flaw removes the expected role checks.