The APIExperts Square for WooCommerce plugin (woosquare) suffers from a missing authorization check, enabling users to perform actions that should be restricted to privileged administrators. This broken access control flaw can allow attackers to view or manipulate sensitive e‑commerce data, such as orders or payment details, thereby compromising confidentiality and integrity. The vulnerability aligns with CWE‑862, an improper authorization weakness.

WordPress plugin "APIExperts Square for WooCommerce" supplied by WPExperts, affecting all releases up to and including version 4.7.5. The issue is present in any installation of the plugin before the 4.7.6 release.

The CVSS score of 5.3 indicates moderate severity, while the EPSS of less than 1% suggests a low probability of exploitation observed in the wild. The flaw is not listed in the CISA KEV catalog. An attacker could exploit the vulnerability by sending crafted requests to exposed plugin API endpoints over the public internet, potentially without needing initial authentication. The impact could elevate a regular user to administrative privileges or allow unauthorized manipulation of e‑commerce transactions.