The Smart Online Order for Clover WordPress plugin suffers from a missing capability check (CWE-862) in multiple functions, enabling authenticated users with low privileges (Subscriber-level and above) to perform unauthorized modifications to product and category information. This vulnerability affects all versions up to and including 1.5.6. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low privileges required and no user interaction needed, resulting in integrity impact but no confidentiality or availability impact.

An attacker with at least Subscriber-level access can alter product and category descriptions, titles, images, and sort order without proper authorization. This could lead to misinformation or manipulation of displayed product data, potentially affecting business operations or customer trust. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor for unauthorized changes to product and category data. Avoid granting unnecessary privileges to low-level authenticated users.