The WooCommerce Tools plugin for WordPress suffers from a missing capability check (CWE-862) in the woocommerce_tool_toggle_module() function across all versions up to 1.2.9. This allows authenticated users with low-level privileges (subscriber and above) to deactivate arbitrary plugin modules without proper authorization. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and no user interaction required, but limited impact to integrity only. No patch or remediation guidance is currently provided by the vendor or public advisories.

An attacker with subscriber-level access or higher can modify the plugin configuration by deactivating arbitrary modules, potentially disrupting functionality or security controls provided by those modules. The vulnerability does not allow data confidentiality compromise or denial of service but permits unauthorized integrity modification of plugin state. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious changes to plugin modules. Avoid granting subscriber or higher privileges to untrusted users to reduce risk.