The vulnerability is a broken access control flaw that allows an attacker to gain unauthorized access to protected areas or data within the MakeCommerce for WooCommerce plugin on WordPress sites. The flaw could enable the attacker to read, modify, or delete sensitive information related to subscribers or orders, compromising confidentiality, integrity, and possibly availability of the e‑commerce store.

The attack affects installations of the MakeCommerce for WooCommerce plugin version 4.1.0 or earlier. The affected vendor is MakeCommerce.net, product MakeCommerce for WooCommerce.

The CVSS score of 8.2 indicates high severity. EPSS data is not available, so the current exploitation likelihood is unknown, and the vulnerability is not listed in the CISA KEV catalogue. The most likely attack vector is a network‑based exploit that takes advantage of the improper access controls exposed by the plugin, enabling an unauthenticated or low‑privilege user to perform actions normally reserved for higher‑privileged roles.