This vulnerability is a missing authorization flaw in the Brainstorm Force CartFlows plugin for WordPress. An attacker can bypass the plugin’s access controls and perform privileged actions that should be restricted to certain user roles. The weakness is identified as CWE‑862, representing an authorization bypass.

All installations of the CartFlows WordPress plugin from any version through 3.3.0 are affected. If your WordPress site uses CartFlows 3.3.0 or earlier, the vulnerability applies. The issue originates from the Brainstorm Force vendor.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw lies in the plugin’s web interface, the likely attack vector involves an attacker crafting HTTP requests to privileged cartflows endpoints on a site where the plugin is installed. Successful exploitation would allow an attacker to gain unauthorized access to configuration functions, potentially altering checkout flows or other sensitive settings.