The ELEX WooCommerce Dynamic Pricing and Discounts plugin suffers from a missing capability check (CWE-862) in its import and export functions for product pricing rules. This lack of authorization verification permits unauthenticated users to perform import/export operations and retrieve phpinfo() output, potentially exposing sensitive configuration data. The vulnerability affects all versions up to and including 2.1.7. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, no privileges required, no user interaction, and limited confidentiality and integrity impact.

An attacker without authentication can access and manipulate product pricing rules by importing and exporting them, which may disrupt pricing configurations. Additionally, the attacker can obtain phpinfo() data, potentially revealing sensitive server environment details. There is no indication of availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's import/export functionality by limiting access to trusted users or disabling these features if possible.