This vulnerability in calliko Bonus for Woo arises from improper validation of user-supplied quantity input, leading to unauthorized access to certain plugin functionality that should be restricted by ACLs. The issue affects all versions up to 7.6.6. The CVSS 3.1 base score is 5.3, with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or vendor advisory has been provided to confirm remediation status.

The vulnerability allows an unauthenticated attacker to access functionality that should be restricted, potentially leading to limited integrity impact within the affected plugin. There is no confidentiality or availability impact reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.