CVE-2024-37203 is a missing authorization vulnerability (CWE-862) in the Laybuy Payment Extension for WooCommerce. It arises from incorrectly configured access control security levels, which may allow users with limited privileges to perform actions they should not be authorized to do. The issue affects versions up to 5.3.9 of the extension. The CVSS 3.1 base score is 4.3, indicating medium severity, with network attack vector, low attack complexity, requiring low privileges and no user interaction, impacting integrity but not confidentiality or availability.

The vulnerability can lead to unauthorized modification or manipulation of data within the Laybuy Payment Extension for WooCommerce, potentially undermining the integrity of payment processing or related operations. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict access to the affected plugin's administrative functions to trusted users only and review permissions carefully to minimize exposure.