CVE-2024-35727 is a CWE-862 Missing Authorization vulnerability in the actpro Extra Product Options for WooCommerce plugin, affecting versions through 3.0.6. The issue arises because the plugin fails to properly enforce authorization checks, allowing users with some privileges to perform unauthorized actions. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or official fix has been published by the vendor as of the latest information.

The vulnerability allows users with limited privileges to perform unauthorized actions within the affected plugin, potentially leading to integrity issues such as unauthorized modifications. There is no impact on confidentiality or availability reported. No known exploitation in the wild has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review user privilege assignments carefully and restrict access to trusted users only. Monitor for vendor updates regarding patches or official fixes.