The vulnerability is an improper access control flaw in the Themeisle PPOM for WooCommerce plugin. It stems from incorrectly configured security levels that allow attackers to bypass intended restrictions and perform actions they should not be able to, potentially compromising the confidentiality, integrity, or availability of the e‑commerce site.

The flaw affects the PPOM for WooCommerce plugin distributed by Themeisle, impacting versions up through 33.0.18. Any installation of the plugin within this version range is susceptible, regardless of the broader WordPress environment.

With a CVSS score of 6.5, the risk is moderate. The EPSS score is not publicly available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker would need to exploit the plugin’s misconfigured access controls, which may require some level of authenticated access within the WooCommerce ecosystem; however, the specific attack vector is not detailed in the advisory.