The StoreCustomizer plugin for WordPress implements StoreCustomizer woocustomizer accesses lacking proper authorization checks, enabling administrators or unauthenticated users to invoke privileged actions such as modifying store settings or viewing sensitive data without the required permissions. This flaw is categorized as a missing authorization vulnerability (CWE‑862).

The vulnerability affects the Kaira StoreCustomizer plugin for WordPress in all releases up to and including version 2.6.3. The advisory does not confirm whether newer releases contain a fix; therefore, the status of versions beyond 2.6.3 remains uncertain and should be evaluated individually.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves crafting HTTP requests that bypass the missing authorization check, allowing an attacker to perform administrative actions over the web interface. If such requests are executed, the attacker could change store configuration, access confidential information, or disrupt service availability.