The vulnerability is a missing authorization flaw in the WP Chill Download Monitor integration for WooCommerce plugin, classified as CWE-862. It permits exploitation of incorrectly configured access control security levels, allowing an attacker to download files or access content that should be restricted to authorized users.

All installations of the WP Chill Download Monitor integration for WooCommerce plugin with a version of 1.0.3 or earlier are affected. The patch introduces version 1.0.4, which removes the flaw.

The CVSS score of 4.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate likelihood of exploitation. The attack vector is inferred to be through web requests to the compromised plugin, meaning any user with network access to the WordPress site could potentially trigger the misuse of download permissions.