Unauthenticated Broken Access Control in the WooCommerce Multivendor Marketplace – REST API plugin, versions 1.6.3 and older, allows attackers to call REST API endpoints without authentication. This flaw is listed under CWE‑862 and enables unauthorized users to read or modify data exposed by the plugin, potentially leaking sensitive information or enabling manipulation of marketplace listings and transactions.

The vulnerability affects the WC Lovers "WooCommerce Multivendor Marketplace – REST API" plugin for WordPress. All installations running version 1.6.3 or earlier are affected; no specific sub‑versions are listed beyond this upper bound.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score is approximately 0.394%, indicating a very low but non‑zero exploitation probability, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is via HTTP requests to exposed REST API endpoints, which can be accessed by any visitor without credentials. Attackers could exploit this to retrieve or alter data, potentially compromising the integrity and confidentiality of marketplace content.