The GSheet For Woo Importer plugin contains a missing capability check in its process_ajax_restore_action() functionality for all releases up to 2.3.1. This oversight allows any authenticated user with Subscriber level permissions and higher to invoke an AJAX request that deletes the plugin’s stored Google Sheets API token and accompanying configuration options. The result is a loss of integration data, potentially interrupting scheduled imports or exposing processes that rely on the API token to fail.

WordPress sites running the GSheet For Woo Importer plugin version 2.3.1 or earlier are impacted. The vulnerability is specific to the mrdollar4444 GSheet For Woo Importer plugin and applies to all WordPress installations that have not upgraded past the 2.3.1 release.

The CVSS score of 4.3 indicates a low to moderate severity, and it is not listed in the CISA KEV catalog. No EPSS score is available, so the exploitation probability cannot be quantified. The vulnerability requires that the attacker be authenticated and possess at least Subscriber permissions; with this access level, the attacker can send an HTTP request to the REST endpoint that initiates the restore action. Once the request is processed, the plugin’s token and settings are removed, causing disruption of the service. No additional conditions or vulnerabilities are needed to trigger the exploit.