The vulnerability originates from a missing authorization check that permits users with improperly configured permissions to execute privileged actions within the WooCommerce upsell plugin. This flaw can be exploited to bypass normal access controls and perform unauthorized operations. The impact is the ability to modify or access data that should be restricted, potentially compromising the store’s configuration and customer information. The weakness is classified as CWE-862: Missing Authorization.

The plugin WP Swings Upsell Order Bump Offer for WooCommerce is affected. All installations of this plugin through the earliest available version up through 3.1.6 are vulnerable. WordPress site owners using any of these versions—regardless of the underlying WordPress core or WooCommerce plugin version—are susceptible.

Security analysts have scored the flaw with a CVSS score of 7.1, indicating high severity. The EPSS score is not available, so the actual exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild. Based on the description, the likely attack vector is interactions with the WordPress site—such as making HTTP requests to the plugin's administrative endpoints—performed by a user with insufficiently restricted permissions. This inference follows from the missing authorization check that would be exercised during such interactions.