The vulnerability is a missing authorization flaw that allows attackers to bypass intended access controls within the Autoship Cloud for WooCommerce Subscription Products plugin. Because the access control is broken, an attacker can potentially view or modify subscription details, leading to confidentiality or integrity compromise of customer data. The weakness maps to CWE‑862, indicating improper authorization handling.

Affected products are the Autoship Cloud for WooCommerce Subscription Products plugin from Patterns In The Cloud, versions up to and including 2.17.1, regardless of the exact lower bound.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. EPSS score of 0.00332 indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the plugin’s web‑based nature, the likely attack vector involves HTTP requests that bypass normal authentication checks. This method would require the attacker to be able to send requests to the plugin’s endpoints, either as an unauthenticated user with insufficient privileges or as an authenticated user exploiting incorrectly defined roles.