The vulnerability described as Missing Authorization allows an attacker to exploit incorrectly configured access control security levels within the VillageTheme HANDMADE – Dropshipping for Etsy and WooCommerce plugin. The flaw is a classic example of broken access control (CWE-862) and can let a user perform actions beyond their intended permissions, potentially manipulating store data or settings. The CVSS score of 7.1 reflects a high impact for potential confidentiality, integrity, and availability compromise for affected WordPress sites.

VillaTheme’s HANDMADE – Dropshipping for Etsy and WooCommerce plugin for WordPress versions up to and including 1.0.10 is affected. Official advice is to upgrade to at least 1.0.11; earlier or unpatched versions remain vulnerable.

The CVSS score of 7.1 indicates a significant risk level, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no current widespread exploitation reports. The likely attack vector involves interaction with the WordPress site via web requests to plugin endpoints, and any authenticated user with insufficient privileges could exploit the flaw to elevate access or modify data.