This vulnerability in WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce (versions up to 1.3.5) is due to missing authorization controls, which can be exploited to escalate privileges. The CVSS 3.1 vector indicates the attack can be performed remotely with low attack complexity and requires privileges, but no user interaction. Successful exploitation results in high impact on confidentiality, integrity, and availability of the affected system. No vendor advisory or patch information is currently available.

An attacker with some level of privilege can exploit this missing authorization vulnerability to escalate their privileges, potentially gaining unauthorized access to sensitive data or administrative functions. This can lead to full compromise of the WooCommerce environment using the affected plugin, impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's functionality to trusted users only and monitor for unusual privilege escalations. Avoid using affected versions of the plugin if possible.