The vulnerability in the ApiExperts Square for WooCommerce plugin is a missing authorization flaw that allows attackers to bypass intended access controls and perform actions reserved for privileged users. If exploited, an attacker could perform any operation exposed by the plugin, potentially exposing sensitive data or manipulating store settings and transactions, thereby compromising the integrity and confidentiality of the site. The weakness is described by CWE-862, which denotes lack of proper authorization checks.

This issue affects installations of the WPExperts APIExperts Square for WooCommerce plugin version 4.7.5 or earlier. The vulnerability exists in any WordPress instance that has the plugin loaded and configured, regardless of the specific WordPress version, as the control issue resides in the plugin code.

The CVSS score for this flaw is 4.3, indicating moderate severity. No EPSS score is available, but the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The attack vector is inferred to be remote, as the flaw lies in a web plugin that can be accessed over HTTP/HTTPS endpoints without additional local privileges.