The Order Notification for WooCommerce plugin versions prior to 3.6.3 contain an improper authentication vulnerability (CWE-287) that overrides WooCommerce's permission checks. This allows any unauthenticated attacker to gain full read and write access to critical store resources including products, coupons, and customer information. The vulnerability is remotely exploitable without any privileges or user interaction, resulting in a critical security risk with a CVSS 3.1 base score of 9.1. No patch or official remediation details are currently provided, and the plugin is not a cloud service, so remediation depends on vendor updates and user action.

Successful exploitation grants unauthenticated attackers complete read and write access to store resources such as products, coupons, and customers. This compromises confidentiality and integrity of the e-commerce store data, potentially leading to unauthorized data disclosure and manipulation. Availability is not impacted. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official vendor channels for a security update addressing this vulnerability. Until a patch is available, consider disabling or restricting access to the affected plugin to prevent exploitation.