This vulnerability involves missing authorization checks in the Vagonic Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products plugin for Woocommerce, versions up to 1.9. It permits users with low privileges to reorder products without proper permission validation. The CVSS score of 4.3 reflects a network attack vector with low attack complexity and requiring low privileges, no user interaction, and impacts integrity only. No patch or remediation information is provided, and the plugin is not a cloud service.

The impact is limited to integrity, allowing unauthorized users with some privileges to reorder products, which could disrupt product display order or business logic relying on product arrangement. There is no impact on confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with appropriate privileges and monitor for suspicious reorder activities. Avoid granting reorder permissions broadly.