The vulnerability in the Green Invoice Morning for WooCommerce plugin is a missing authorization flaw that allows attackers to bypass normal checks and access privileged functions or data. This breach can lead to unauthorized modification or exposure of sensitive information. The weakness matches CWE-862, which involves improper authorization checks.

The affected systems are WordPress sites that have installed the Green Invoice Morning for WooCommerce plugin at versions up to and including 2.4.1. No patch version is listed in the data, but the issue is specific to all releases 2.4.1 or earlier.

The CVSS score for this flaw is 7.5, indicating a high risk to confidentiality and integrity. The EPSS score is 0.00202, which is less than 1%. The vulnerability is not listed in the CISA KEV catalog. The CNA recommends updating to at least version 2.4.2 to address the issue. Because the flaw can be exploited with no authentication, the likely attack vector is a web-based request to a vulnerable endpoint or admin interface, allowing an attacker to send crafted requests from any IP.