The Dreamfox Media Payment gateway per Product for Woocommerce plugin suffers from a missing authorization vulnerability that results from improperly configured access control security levels. This flaw affects versions up to and including 3.5.6 and allows an unauthenticated attacker to perform actions requiring authorization, potentially impacting the integrity and availability of the affected system. The vulnerability is network exploitable with low attack complexity and requires user interaction. Confidentiality impact is not present, but integrity and availability impacts are low and low respectively.

An attacker can exploit the missing authorization to perform unauthorized actions that may alter data or disrupt service availability within the affected Woocommerce plugin. Confidentiality is not impacted. The overall impact is medium severity based on the CVSS score of 6.1. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.