CVE-2024-10853 is a missing authorization vulnerability (CWE-862) in the Buy one click WooCommerce WordPress plugin. The issue arises because the removeorder AJAX action does not perform capability checks, enabling authenticated users with low privileges (Subscriber-level and above) to delete orders. This vulnerability affects all versions up to and including 2.2.9. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges, causing limited impact to integrity but no confidentiality or availability impact.

An attacker with Subscriber-level access or higher can delete Buy one click WooCommerce orders without authorization. This impacts data integrity by allowing unauthorized modification (deletion) of order data. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to order deletions. Avoid granting Subscriber-level access to untrusted users. Follow updates from the northmule vendor for an official patch or temporary mitigation.