This vulnerability is due to missing authorization in the WebToffee Order Export & Order Import plugin for WooCommerce, specifically affecting versions up to 2.6.7. The issue allows exploitation of incorrectly configured access control security levels, potentially enabling users with some privileges to perform actions or access data that should be restricted. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges, but no user interaction. The impact is limited to partial confidentiality loss without affecting integrity or availability.

The impact is limited to partial confidentiality loss due to missing authorization checks. There is no impact on data integrity or system availability. The vulnerability could allow an attacker with some privileges to access order export or import functionality without proper authorization, potentially exposing order data. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict access to the plugin's functionality to trusted users only and review user privileges carefully to minimize risk.