The vulnerability is a missing authorization issue in PI Web Solution Live sales notification for WooCommerce. It allows actors to bypass the plugin’s configured access control security levels and retrieve sale notifications. This can result in unauthorized disclosure of notification data stored by the plugin.

WordPress sites that install PI Web Solution Live sales notification for WooCommerce in any version up to and including 2.3.60 are vulnerable. The vulnerability affects all releases of the plugin from the earliest mentioned build through 2.3.60.

Based on the CVSS base score of 5.3, the vulnerability represents a moderate risk. The EPSS score is less than 1 %, indicating a low probability of exploitation, and it is not listed in CISA’s KEV catalog. The likely attack vector is via the WordPress administrative interface or through an authenticated user with insufficient role restrictions, allowing read access to sale notification data that should otherwise be protected.