A missing authorization check in the Web Impian Bayarcash WooCommerce plugin allows an attacker to invoke privileged plugin endpoints without proper role validation. The flaw is a classic Broken Access Control weakness (CWE‑862) that can enable unauthorized users to alter plugin settings, manage orders, or view confidential information via the WooCommerce interface or API. The impact is therefore the compromise of confidentiality, integrity, and availability of e‑commerce data.

Vendors affected are Web Impian Bayarcash WooCommerce with the Bayarcash‑wc plugin. All releases up to and including version 4.4.2 are impacted. Versions 4.4.3 and later contain the fix.

The CVSS score of 7.5 indicates a high severity. Enumeration of the exploit probability is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through the public web interface or plugin API, where an attacker can send crafted requests to endpoints that bypass role checks. Successful exploitation would grant access to privileged operations without authentication, conditional on the target website exposing the vulnerable plugin endpoints.