The vulnerability identified as CVE-2025-22673 affects the WPFactory EAN for WooCommerce plugin, specifically versions up to and including 5.3.5. It is caused by missing authorization checks, which means that certain operations can be performed without verifying if the user has the appropriate permissions. The CVSS vector indicates the attack can be performed remotely over the network with low complexity and requires low privileges, but no user interaction is needed. The impact is limited to confidentiality loss with no integrity or availability impact. No official patch or vendor advisory is currently available.

An attacker with low privileges could exploit this missing authorization vulnerability to access or perform actions that should be restricted, potentially leading to limited confidentiality breaches. There is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin features to trusted users only and monitor for unusual activity related to EAN for WooCommerce. Avoid granting unnecessary privileges to users who interact with this plugin.