An unauthenticated broken access control flaw exists in the WordPress Mobile App for WooCommerce plugin versions 0.4.62 and earlier. The weakness, identified as CWE‑862, allows an attacker without valid credentials to access functionalities that should be restricted to authorized users, potentially exposing sensitive store data or administrative controls.

Vendors involved include Weptile, specifically the Mobile App for WooCommerce plugin. All releases up to and including version 0.4.62 are vulnerable.

The CVSS score of 8.6 indicates high severity. While no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the absence of an authentication requirement suggests the attack can be carried out remotely by anyone who can reach the plugin’s interface. This raises the likelihood of exploitation in environments where the plugin is exposed to the public internet.