This vulnerability in cedcommerce Ship Per Product (<= 2.1.0) is due to missing authorization checks, enabling unauthorized access to certain functions that should be restricted by Access Control Lists (ACLs). The CVSS score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to availability, with no confidentiality or integrity impact reported. No patch or official remediation information is provided at this time.

The vulnerability allows unauthorized users to access functionality that should be protected by authorization controls, potentially leading to denial of service or disruption of service availability. There is no impact on data confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to Ship Per Product functionality. Avoid exposing the affected functionality to untrusted users.