The WC Plus plugin for WordPress suffers from a missing capability check on the ‘pluswc_logo_favicon_logo_base’ AJAX action in all releases up to and including 1.2.0. The flaw allows any remote user to send crafted requests without authentication and alter the website’s favicon logo base. This change can be leveraged to misdirect visitors, undermine brand trust, or facilitate phishing attacks by swapping the site icon. The weakness is classified as CWE‑862 for missing authorization checks, indicating that access control controls are incorrectly implemented.

WC Plus plugin for WordPress, versions up to and including 1.2.0. The vulnerability affects all installations of the plugin within this version range, regardless of site configuration.

The CVSS score of 5.3 indicates a moderate impact if the flaw is exploited. The EPSS score of less than 1% suggests that the probability of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote via unauthenticated AJAX requests; an attacker can send a request to the vulnerable endpoint from any network without needing credentials. Exploit complexity is low, and the required privileges are none, making the vulnerability achievable for any potential attacker that can target the site.