CVE-2025-50008 describes a missing authorization vulnerability in the cscode WooCommerce Manager plugin for WordPress, which customizes and controls the cart page, Add to Cart button, and checkout fields. The flaw arises from incorrectly configured access control security levels, allowing an attacker with low privileges to perform unauthorized actions affecting data integrity and availability. The vulnerability affects versions up to 1.2.4.5. The CVSS 3.1 base score is 5.4 (medium severity), with network attack vector, low attack complexity, low privileges required, no user interaction, and unchanged scope. No patch or vendor advisory is currently available.

The vulnerability does not compromise confidentiality but can lead to unauthorized modification or disruption of plugin functionality, impacting integrity and availability. An attacker with low privileges can exploit the missing authorization to perform actions they should not be allowed to, potentially affecting the e-commerce workflow managed by the plugin. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with trusted privileges and monitor for unusual activity related to the WooCommerce Manager plugin. Avoid granting unnecessary permissions to users who can interact with the plugin's features.