The vulnerability arises from missing authorization checks in the Flexible Quantity – Measurement Price Calculator for WooCommerce plugin, allowing attackers to exploit misconfigured access controls and perform actions beyond their intended permissions. Classified as CWE-862, the flaw permits unauthorized manipulation of pricing parameters, incorrect measurement-based price calculations, or unauthorized access to configuration data. This could lead to revenue loss or misreported sales for affected sites.

The vendor WP Desk distributes the Flexible Quantity – Measurement Price Calculator for WooCommerce plugin. All releases up to and including version 2.3.23 are impacted. Any WordPress site that has installed this plugin in that version range is at risk, regardless of other security measures.

The CVSS score of 5.3 indicates medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is an authorization failure, the likely attack vector requires some form of authenticated access to the WooCommerce admin interface; however, the advisory does not specify prerequisites, so this is inferred. The combination of medium severity, lack of known exploits, and the need for authenticated access implies a moderate risk level, but administrators should still treat the issue with priority.