The Product Configurator for WooCommerce WordPress plugin before version 1.7.3 does not enforce authorization or validate the post status before returning product data through a public AJAX action. An attacker can supply any product ID, causing the endpoint to reveal sensitive attributes—title, price, weight, stock status, and configurator option pricing or SKUs—of private or draft products. The weakness corresponds to missing authorization checks (CWE‑284 and CWE‑285).

Any WordPress site that WooCommerce plugin with a version older than 1.7.3 is affected; the vendor is unspecified.

The public AJAX endpoint can be accessed by unauthenticated users, so the attack vector is likely external, web‑based requests. The CVSS score of 7.5 signals a moderate‑high severity, and the EPSS score of less than 1 % indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the endpoint lacks authentication checks, sites that expose private or draft product data are at significant risk of disclosing confidential product details.