The vulnerability is an Insecure Direct Object Reference (IDOR) in the WC Ukraine Shipping WordPress plugin up to version 1.22.3. It allows an attacker who can craft HTTP requests to the plugin’s subscriber‑data endpoints to retrieve, modify, or delete subscriber information without proper authorization. The weakness is classified as CWE‑639 and can compromise the confidentiality and integrity of subscriber data.

Affected systems are WordPress sites that use the WC Ukraine Shipping plugin developed by kirillbdev. All releases from the initial launch through version 1.22.3 are susceptible. No other vendors or product versions are listed as impacted.

The CVSS score of 7.1 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based; an attacker can send targeted requests to the plugin’s endpoints with manipulated subscriber identifiers, bypassing authentication checks. Successful exploitation would give the attacker unauthorized read/write access to subscriber data.