The ShopApper plugin for WooCommerce allows an authenticated user to update the stock quantity of any product through a REST endpoint without checking the user’s capabilities. This omission lets any logged‑in user—including customers or subscribers—alter inventory data, potentially causing stock shortages, erroneous sales, and revenue loss. The weakness is a classic authorization bypass, aligning with the CWE-284 class of improper privilege. The lack of capability checks also makes it a direct method of privilege escalation within the WooCommerce environment.

The vulnerability exists in the Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin for all releases up to and including version 0.4.62. All sites running these versions are affected.

Because the flaw requires only authentication, attackers who can log in as a customer or subscriber can exploit it. The EPSS score is less than 1%, and it is not listed in the CISA KEV catalog, indicating a low but non‑zero exploitation probability. The CVSS score of 4.3 reflects moderate risk; the issue still allows unauthorized modification of inventory data, which can impact revenue and operational integrity. The attack surface is limited to the REST API, and attackers need to construct a valid request to change stock values.