This vulnerability is due to missing authorization in the WebToffee Product Feed for WooCommerce plugin, affecting versions up to 2.3.1. It allows exploitation of incorrectly configured access control security levels, potentially enabling users with low privileges to access certain features or data without proper authorization. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, and limited confidentiality impact. No official patch or mitigation details are provided in the available data.

The impact is limited to partial confidentiality loss, with no impact on integrity or availability. Attackers with low privileges may gain unauthorized access to some data or functionality within the plugin. There are no reports of exploitation in the wild, and the vulnerability does not allow privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted users only and monitor for unusual activity related to the Product Feed for WooCommerce plugin. Avoid granting unnecessary privileges to users who can interact with this plugin.