The vulnerability identified as CVE-2025-32544 affects WooCommerce Loyal Customers plugin versions up to 2.6. It is a missing authorization issue where certain functionality is accessible without proper ACL enforcement, enabling unauthorized access. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact. The vendor has not provided a patch or advisory, and the plugin is not a cloud service, so remediation depends on vendor updates or user mitigation.

An attacker can remotely access sensitive functionality without authorization, potentially leading to unauthorized disclosure of confidential information. There is no impact on integrity or availability according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the plugin's functionality via other means such as web application firewalls or limiting plugin usage to trusted users only. Monitor official channels for updates from The Right Software regarding patches or mitigations.