The vulnerability identified as CVE-2025-54692 affects the WP Swings Membership For WooCommerce plugin through missing authorization controls. Specifically, certain functionality is accessible without proper ACL enforcement, potentially allowing unauthorized access to sensitive membership features. The issue impacts all versions up to 2.9.0. The CVSS 3.1 base score of 7.5 reflects a high severity due to the vulnerability's network accessibility, lack of required privileges, and significant confidentiality impact. No official patch or mitigation guidance is currently documented, and no exploits have been reported in the wild.

An attacker can remotely access functionality within the Membership For WooCommerce plugin that should be protected by authorization controls, potentially leading to unauthorized disclosure of sensitive membership-related information. The vulnerability does not affect integrity or availability but poses a high confidentiality risk. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's administrative and membership management interfaces and monitor for updates from WP Swings. Avoid exposing the affected plugin functionality to untrusted users or networks where possible.