The vulnerability identified as CVE-2024-31098 affects the Mr.Ebabi New Order Notification plugin for Woocommerce through version 2.0.2. It is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly enforce authorization checks. This allows an attacker with low privileges to access or perform actions that should require higher authorization, impacting confidentiality and integrity. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity, with no impact on availability. There is no vendor advisory or patch available yet.

The vulnerability can lead to unauthorized access or modification of sensitive information related to new order notifications in the affected plugin. Confidentiality and integrity impacts are rated high, meaning sensitive data could be disclosed or altered by an attacker with low privileges. Availability is not impacted. No known exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin's functionality to trusted users only and monitor for unusual activity related to order notifications. Avoid granting unnecessary privileges to users who can interact with this plugin.