This vulnerability is a missing authorization issue in the Display product variations dropdown on the shop page developed by Anzar Ahmed. It allows exploitation of incorrectly configured access control security levels, potentially enabling users with low privileges to perform unauthorized actions. The affected versions include all versions up to 1.1.3. The CVSS score is 4.3 (medium), with an attack vector of network, low attack complexity, requiring privileges, no user interaction, and impacts integrity but not confidentiality or availability.

The impact is limited to integrity, meaning unauthorized users with some privileges could modify or manipulate product variation data on the shop page. There is no impact on confidentiality or availability. The vulnerability requires the attacker to have some level of privileges and can be exploited remotely without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations for the Display product variations dropdown on the shop page to prevent unauthorized actions by users with limited privileges.