The dugudlabs Eyewear prescription form plugin for WordPress suffers from a Missing Authorization vulnerability (CWE-862) affecting all versions up to and including 6.0.1. The vulnerability arises because the RemoveItems AJAX action does not perform capability checks, enabling unauthenticated attackers to delete WooCommerce product categories arbitrarily by specifying category IDs in the 'catIds' parameter. This can lead to unauthorized modification of product category data within affected WooCommerce installations.

The vulnerability allows unauthenticated attackers to delete WooCommerce product categories and their child categories, resulting in unauthorized modification of e-commerce product data. This can disrupt the organization and availability of product categories but does not directly impact confidentiality or availability of the system beyond the integrity loss of category data. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AJAX endpoint if possible and monitor for suspicious activity related to category deletions. Avoid exposing the vulnerable plugin on publicly accessible sites without additional protective controls.