The vulnerability is a missing authorization flaw that allows users to perform bulk edit operations on products in WooCommerce without proper permission checks. Because the plugin does not enforce the correct access control, an attacker or an unauthorized user could modify product data, potentially altering pricing, availability, or other critical attributes. This flaw falls under CWE‑862, which describes failures to verify an entity’s rights to perform an action.

The affected component is the WooCommerce Bulk Edit Products – WP Sheet Editor plugin, version 1.8.21 and earlier. The vendor is Jose Vega. Users who have installed this plugin in WordPress sites are affected.

The CVSS score of 4.9 indicates moderate severity, but the EPSS score of less than 1% shows exploitation is expected to be rare. The vulnerability is not listed in CISA KEV, suggesting it is not currently known as a widely exploited flaw. Based on the description, it is inferred that the likely attack vector is through a logged‑in user with an unexpected role that the plugin incorrectly trusts; exploiting the flaw would typically require access to the WordPress admin area with at least read permissions, but an attacker could co‑ordinate with a compromised account or elevate privileges through the plugin’s exposed bulk edit endpoints.