Unauthenticated Broken Access Control in the WordPress plugin allows an attacker who can access the website to bypass authentication checks and perform privileged actions related to the StoreGrowth features. The exploit can potentially expose sensitive configuration data or content, alter sales or checkout settings, or otherwise tamper with the e‑commerce environment. The vulnerability is grounded in CWE-862, indicating that the component does not enforce proper authorization constraints. The upfront impact is that confidentiality, integrity, and availability of the e‑commerce functions may be compromised if the attacker can effectively modify or view protected operations.

The affected systems are WordPress sites that have installed the weDevs "StoreGrowth: Smart Sales Booster for WooCommerce" plugin version 2.1.1 or earlier. Any site running these plugin versions, regardless of user role, is vulnerable because the access control checks are missing or ineffective. The vulnerability does not appear to be limited by operating system or web server, as it is tied to the plugin code itself.

The CVSS score of 7.5 indicates a high severity that can lead to significant damage if exploited. No EPSS score is available, so the exploitation probability cannot be quantified from the data. The plugin is not listed in the CISA KEV catalog, implying no known active exploitation campaigns have been documented at the time of this assessment. The likely attack vector is through standard web requests to plugin endpoints that should be protected by authentication. An attacker with network or web access could craft a request to trigger the privileged functionality without proper authentication. Given the lack of mitigation notes in the official CNA data, the risk remains high until a vendor patch or a suitable workaround is applied.