CVE-2024-9109 is a missing authorization vulnerability (CWE-862) in the WooCommerce UPS Shipping – Live Rates and Access Points plugin by octolize. The issue arises because the delete_oauth_data function lacks proper capability checks, enabling authenticated users with low privileges (Subscriber-level and above) to delete the plugin's API key. This could disrupt the plugin's functionality by removing critical API credentials. The vulnerability is present in all versions up to 2.3.12. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, and limited impact on integrity without affecting confidentiality or availability.

An attacker with at least Subscriber-level access can delete the plugin's API key, potentially disrupting the plugin's ability to communicate with UPS services. This results in an integrity impact by unauthorized modification of plugin data. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only, as the vulnerability requires authenticated access at Subscriber level or higher. Monitor for vendor updates to apply an official patch once available.