The vulnerability is a missing authorization flaw that allows users with insufficient privileges to perform actions beyond their intended permissions. This can lead to unauthorized data exposure, tampering, or other privileged operations within the WooCommerce instance. The weakness is classified as CWE‑862, a Control Flow or Authorization flaw.

The affected vendor is Codection, product "Products Restricted Users for WooCommerce" for any version up to and including 0.7. No specific sub‑versions are listed beyond the 0.7 upper bound.

The CVSS score of 5.3 indicates medium overall risk. EPSS is not available, so the likelihood of exploitation cannot be quantified from the data. The vulnerability is not currently listed in CISA KEV. Based on the description, the likely attack vector is web‑based through the WooCommerce/WordPress site—an attacker could craft a request that bypasses the plugin’s access checks to gain elevated capabilities. If the plugin’s access controls are incorrectly configured, any authenticated user might be able to exploit this flaw.