This vulnerability involves missing authorization controls in the Music Player for WooCommerce plugin by codepeople, allowing users with limited privileges to perform actions beyond their intended permissions. The affected versions are from initial releases through 1.5.1. The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and resulting in limited integrity and availability impacts. No patch or vendor advisory is currently available to confirm remediation status.

Exploitation of this vulnerability could allow an attacker with some privileges to bypass access control restrictions, potentially modifying or disrupting plugin functionality. The impact is limited to integrity and availability, with no confidentiality loss indicated. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict user privileges carefully to minimize exposure. Monitor for updates from the vendor or security advisories to apply patches promptly once available.