The UpsellWP checkout‑upsell‑and‑order‑bumps plugin contains a missing authorization flaw that lets attackers exploit incorrectly configured access control security levels. The flaw could allow a user without proper permissions to reach protected functions, potentially manipulating orders, modifying pricing settings, or viewing sensitive order details. The vulnerability is classified as CWE‑862, indicating a missing authorization issue.

This vulnerability affects WordPress sites that have the UpsellWP plugin version 2.2.5 or earlier. The plugin is distributed by flycart under the UpsellWP name. No specific WordPress core versions are mentioned, so the flaw exists whenever the affected plugin is installed on any supported WordPress installation.

The CVSS score of 4.3 suggests moderate risk. The EPSS score of less than 1% indicates that exploitation is considered unlikely at the moment. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin's web interface, as the flaw stems from improperly enforced access control. An attacker would need to target a site using the vulnerable plugin and exploit the accessible endpoints to gain unauthorized access.