The plugin’s configuration management lacks proper authorization checks, allowing an attacker who can craft requests to the plugin’s endpoints to reorder or reposition products without authorization. This flaw is a missing‑authorization weakness that lets unauthorized users perform actions intended for privileged roles.

Affected systems are WordPress sites running the Devteam HaywoodTech Product Rearrange for WooCommerce plugin through version 1.2.2. The plugin modifies WooCommerce product ordering, and until this version the authorization logic was incomplete, exposing stores to insecure changes.

With a CVSS score of 8.2 the issue is high severity, but the EPSS score indicates exploitation is unlikely (<1%) and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation would occur via the WordPress admin interface by any authenticated user, so the impact is confined to configuration changes of product arrangement.