The vulnerability is an unauthenticated broken authentication flaw in the Upsell Order Bump Offer for WooCommerce plugin that allows an adversary to manipulate the price of products during checkout without needing to log in; the flaw is identified by CWE‑1284 and compromises the integrity of e‑commerce transactions rather than providing code execution.

Affected systems include the WP Swings Upsell Order Bump Offer for WooCommerce plugin versions 3.1.4 and earlier, installed on WordPress sites that use WooCommerce for online sales.

The CVSS score of 7.5 indicates a high severity vulnerability while the EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild; the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is the web interface, based on the description it is inferred that attackers can exploit it by submitting requests that bypass authentication. This gives the risk a moderate level in environments that rely heavily on this plugin for sales.