The vulnerability is a missing authorization check in the BjornTech Swish for WooCommerce plugin, allowing users to access features that should be restricted. This broken access control can enable attackers to perform privileged actions such as creating, modifying, or approving transactions without proper authentication. It represents a classic authorization flaw that directly compromises the integrity of e‑commerce operations.

WordPress sites that have the BjornTech Swish for WooCommerce plugin installed. Versions from the earliest released through 3.7.8 are affected. The plugin is identified by the vendor BjornTech and the product Swish for WooCommerce. No other versions are listed as vulnerable.

The CVSS score of 6.5 indicates a medium severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The Likely attack vector is remote, via web requests to privileged plugin endpoints, because the flaw involves missing checks at the application level. An attacker can exploit the flaw by authenticating to the site with an account that can reach the plugin’s administrative interface or by exploiting the publicly accessible endpoints if the site does not restrict access.