The Product Specifications for WooCommerce plugin does not verify the user’s capability or a nonce when handling the ‘dwps_modify_groups’ and ‘dwps_modify_attributes’ AJAX actions. This omission allows an authenticated user with Subscriber level or higher to create, edit, or delete product specification groups and attributes, which are taxonomy terms that control how product information appears on the front end. The resulting data corruption can alter product listings, misrepresent inventory, and undermine customer trust. The weakness is identified as CWE-862, a missing authorization check that permits data modification beyond the intended role boundaries.

Any WordPress site running the Product Specifications for WooCommerce plugin up to and including version 0.8.9 is affected. The vulnerability exists within the AttributeGroupController and AttributeController classes of these versions, and it applies to sites that have the plugin activated without additional hardening.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is not available, so the probability of exploitation is currently unknown. Because the flaw requires an authenticated Subscriber or higher, an attacker would need prior access to a user account; the vulnerability is not in CISA’s KEV catalog. Once an authenticated user exploits the flaw, they can alter or delete critical data but cannot execute code or compromise the site’s overall platform. However, the business impact can be substantial if customer-facing product information becomes inconsistent or incorrect.