The WordPress Bayarcash WooCommerce plugin has a missing authorization flaw that allows attackers to bypass correctly configured access control settings. This defect aligns with CWE‑862 and permits exploitation of protected resources without proper authentication. If an attacker can reach the vulnerable components, they may view, modify, or delete sensitive data, potentially exposing user information or disrupting e‑commerce operations.

Affected product is the Bayarcash WooCommerce plugin, distributed by Web Impian. All releases from the first version through 4.3.13 are impacted; newer releases are not affected.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is under 1%, suggesting a low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based solely on the description, the most likely attack vector is through the web interface of a site running the plugin, where an attacker could craft requests that bypass role checks. No additional prerequisites such as elevated privileges or network access are mentioned, so a remote attacker with internet access to the site could potentially exploit the flaw.