The vulnerability is a missing authorization flaw that allows attackers to exercise functions of the APIExperts Square for WooCommerce plugin that should be protected by access control checks. Because authentication or privilege verification is not performed correctly, an attacker can perform operations intended for privileged users, potentially exposing sensitive data or manipulating commerce transactions.

Any WordPress installation that has the APIExperts Square for WooCommerce plugin with a version of 4.7.5 or earlier. The flaw is present from the initial feature release through version 4.7.5, affecting all sites that did not upgrade past that release.

The CVSS score of 5.3 indicates a moderate risk level. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is exploitation of exposed API endpoints that lack proper authorization checks; an attacker may not need elevated privileges to trigger the flaw, depending on configuration. The impact could be unauthorized data access or transaction tampering, with potential confidentiality and integrity consequences.