This vulnerability in WebToffee eCommerce Marketing Automation (<= 2.1.1) arises from missing authorization checks in the decorator-woocommerce-email-customizer module. An attacker with low privileges can exploit this issue due to incorrectly configured access control, potentially gaining unauthorized access to certain functionalities or data. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, and no user interaction required, with limited confidentiality impact and no impact on integrity or availability.

The vulnerability could allow an attacker with low privileges to access or manipulate parts of the WebToffee eCommerce Marketing Automation plugin without proper authorization, potentially leading to limited confidentiality exposure. There is no indication of impact on data integrity or system availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin components to trusted users only and monitor for unusual activity related to the decorator-woocommerce-email-customizer functionality.