The Addonify Floating Cart For WooCommerce plugin suffers from a missing authorization vulnerability (CVE-2025-68025) in versions up to 1.2.17. This issue arises due to improperly configured access control security levels, allowing unauthenticated attackers to perform actions that should require authorization. The CVSS 3.1 base score is 6.5, with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts rated low and low respectively. No patch or vendor advisory is currently available to confirm remediation status.

Exploitation of this vulnerability could allow an attacker to perform unauthorized actions within the affected plugin, potentially leading to integrity and availability issues. Confidentiality is not impacted. The medium severity score reflects the potential for disruption or unauthorized modification of plugin functionality, but no evidence of active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin's functionalities and monitor for updates from Addonify. No vendor advisory or patch links are currently available.