This vulnerability (CWE-862) in YITH WooCommerce Account Funds Premium involves missing authorization controls, allowing users with limited privileges to perform unauthorized actions related to account funds. It affects versions up to 1.33.0. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No official fix or vendor advisory detailing remediation is currently available.

The vulnerability could allow an attacker with some level of privilege to modify account funds without proper authorization, impacting the integrity of user account balances. There is no confidentiality or availability impact reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to trusted users only and monitor for suspicious activity related to account funds. Avoid granting unnecessary privileges to users interacting with the plugin.