The vulnerability identified as CVE-2024-37202 affects the Ultimate Custom Add To Cart Button (Ajax) plugin for WooCommerce by Binary Carpenter. It is classified as a missing authorization issue, meaning that the plugin fails to properly verify user permissions before allowing certain actions. This can lead to unauthorized operations by users with limited privileges. The affected versions include all versions up to 1.222.17. The CVSS 3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with some privileges to perform unauthorized actions within the plugin context, potentially leading to partial compromise of data confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time, and the impact is limited to the scope of the plugin's functionality within WooCommerce environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor for updates from Binary Carpenter and apply any official patches once released. In the meantime, review user privileges and restrict access to trusted users only to minimize risk.