This vulnerability in centangle Direct Checkout for WooCommerce Lite (<= 1.0.3) is due to missing authorization checks, allowing unauthenticated users to access functionality that should be restricted by access control lists (ACLs). The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

The vulnerability allows unauthorized users to invoke certain functions within the plugin that are not properly protected by authorization mechanisms. This can lead to integrity issues, such as unauthorized modification of data or actions within the WooCommerce checkout process. There is no impact on confidentiality or availability reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, users should monitor for updates from centangle and apply any official fixes once available. Until then, consider restricting access to the affected plugin functionality through other means or disabling the plugin if feasible.