CVE-2024-9189 is a missing authorization vulnerability (CWE-862) in the EU/UK VAT Validation Manager for WooCommerce plugin for WordPress. The vulnerability arises from the absence of a capability check in the alg_wc_eu_vat_exempt_vat_from_admin() function, allowing unauthenticated attackers to update the VAT status of any order. This affects all versions up to and including 2.12.12. The CVSS 3.1 base score is 5.3 (medium), with attack vector network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker without authentication can modify the VAT status of orders, potentially leading to incorrect tax processing or financial discrepancies. There is no direct confidentiality or availability impact reported. The integrity of order data related to VAT status is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's administrative functions and monitor for suspicious activity related to VAT status changes. Avoid exposing the plugin's administrative endpoints to untrusted users.