The vulnerability identified as CVE-2025-30959 involves missing authorization checks in the WPFactory Product XML Feed Manager for WooCommerce plugin (versions <= 2.9.2). This results from incorrectly configured access control security levels, allowing unauthenticated remote attackers to perform actions that could affect the integrity and availability of the affected system. The CVSS 3.1 base score is 6.5, with attack vector network, low attack complexity, no privileges required, no user interaction, and impacts limited to integrity and availability.

Exploitation of this vulnerability could allow an unauthenticated attacker to perform unauthorized actions that may alter data or disrupt service availability within the affected WooCommerce plugin environment. Confidentiality is not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's interfaces and monitor for unusual activity related to XML feed management. Avoid exposing the plugin's management endpoints to untrusted networks.