This vulnerability (CWE-862) in WooCommerce Box Office involves missing authorization checks, which could allow a user with low privileges to perform actions or access resources that should require higher authorization. The affected versions include all releases up to 1.2.2. The CVSS score of 6.5 reflects a network attack vector with low complexity, requiring privileges but no user interaction, and impacts confidentiality with no integrity or availability impact. No vendor advisory or patch information is currently available.

An attacker with low privileges could potentially access or perform actions beyond their authorization scope, leading to unauthorized disclosure of sensitive information. There is no indication of integrity or availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to the minimum necessary and monitor for unusual activity related to WooCommerce Box Office. Avoid granting unnecessary permissions to users who can interact with this plugin.