The License Manager for WooCommerce plugin suffers from a missing authorization flaw that allows attackers to delete any content managed by the plugin. Because the vulnerability stems from incorrectly configured access control, the attacker does not need privileged credentials; any user who can reach the plugin’s endpoints may trigger deletion. The impact is the loss of important product listings, coupons, or other managed data, which can disrupt e-commerce operations and damage customer trust.

All versions of Saad Iqbal’s License Manager for WooCommerce up to and including 3.0.17 are affected. The plugin lacks the necessary capability checks in the code path responsible for content removal, exposing all installations within this version range to deletion risk.

The CVSS v3.1 score of 5.4 categorizes the issue as medium severity, while the EPSS score of less than 1 percent indicates a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been publicly exploited at scale. Based on the description, it is inferred that attackers would likely submit a crafted HTTP request to the plugin’s deletion endpoint, which the code processes without verifying the caller’s privileges. The likely attack vector is an unauthorized or low‑privilege user exploiting the deletion endpoint. The combination of a moderate severity score and low exploitation likelihood makes the risk moderate but warrants timely remediation.