Technical impact
Missing Authorization vulnerability in the VillaTheme DEPART plugin allows an attacker to exploit incorrectly configured access control levels. This flaw can be used to bypass normal authorization checks and perform actions intended for privileged users, potentially leading to unauthorized data disclosure or modification. The weakness is categorized as broken access control (CWE-862).
Affected Systems
This issue affects the DEPART plugin for WordPress, version 1.0.10 and earlier. The plugin, developed by VillaTheme, is designed to manage deposit and part payment functionality for WooCommerce stores. Any WordPress site that has a vulnerable version installed is potentially affected.
Risk and Exploitability
With a CVSS score of 4.3, the vulnerability is assessed as moderate severity. EPSS is not available and the flaw is not listed in CISA KEV, indicating no widespread exploitation is currently documented. The attack vector is inferred to be web-based; an attacker may exploit the flaw by sending crafted requests to the plugin's endpoints, potentially requiring an authenticated session or exploiting misconfigured roles. The impact may permit unauthorized actions that compromise data integrity and confidentiality on an affected WordPress site.
