This vulnerability (CWE-862) in the Location Picker at Checkout for WooCommerce plugin by Uriahs Victor involves missing authorization controls, which could allow users with some privileges to perform unauthorized actions during the checkout process. The affected versions include all versions up to 1.8.9. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and limited impact on integrity without affecting confidentiality or availability. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

The vulnerability could allow an attacker with some level of privileges to perform unauthorized actions related to the location picker functionality at checkout, potentially impacting data integrity. Confidentiality and availability are not affected according to the CVSS vector. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review user privileges carefully and restrict access to trusted users only. Monitor for vendor updates regarding patches or official mitigations.