A missing authorization flaw (CWE‑862) in the Dotstore Fraud Prevention For Woocommerce plugin allows an attacker to delete any content, including posts, pages, or orders, because the access‑control checks fail to verify proper permissions before deletion is processed. The flaw arises from incorrectly configured security levels that do not enforce role‑based restrictions on delete operations, thereby compromising the integrity of the site’s data.

WordPress sites that have installed the Dotstore Fraud Prevention For Woocommerce plugin—also known as woo‑blocker‑lite‑prevent‑fake‑orders‑and‑blacklist‑fraud‑customers—in any released version up through 2.3.3 are affected. Sites running a newer version are not vulnerable.

The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation. The likely attack vector is an authenticated user who gains privileged access to the plugin’s back‑end, either through credential compromise or by exploiting other authentication weaknesses. Once authenticated, the attacker can invoke the deletion endpoint and remove arbitrary content, leading to loss of data and potential service disruption. The impact covers integrity and availability, and the overall risk warrants prompt remediation.