This vulnerability involves broken access control in the CartFlows plugin for WordPress, allowing attackers to bypass authorization checks. The flaw enables unauthorized users to perform restricted actions, potentially exposing configuration data or manipulating the plugin’s behavior. The weakness is classified as CWE-862, reflecting improper authorization control.

WordPress sites that use the Brainstorm Force CartFlows plugin with versions up to and including 2.2.3 are affected. No other vendors or product variants are listed as impacted.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score of less than 1% suggests low likelihood of exploitation. The vulnerability is not recorded in the CISA KEV catalog. Because the flaw arises from missing authorization logic within the plugin, the likely attack vector is a web-based exploitation against the affected WordPress installation. No public exploit code has been identified, but the weakness could be leveraged by any authenticated or unauthenticated user who can target the plugin’s administrative endpoints.