The vulnerability in the WooODT Lite plugin allows an attacker to bypass authentication by spoofing identities, effectively letting them act as another user without proper credentials. This can enable fraudulent payments or other privileged actions that normally require verified user identities. The weakness is classified as an authentication bypass via spoofing (CWE‑290).

All installations of the WooODT Lite WordPress plugin produced by the vendor mdalabar, including any versions up to and including 2.5.2. The issue affects every deployment that has not yet been patched beyond this threshold.

The vulnerability carries a high CVSS score of 7.5, indicating a serious potential impact. The EPSS score of less than 1 % suggests that, at present, exploitation is not common, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve manipulating the plugin’s HTTP endpoints or administrative interface to craft spoofed requests that are accepted by the unauthenticated authentication checks. A successful exploit would grant the attacker the same permissions as the targeted user, potentially leading to unauthorized financial transactions or data access.