This vulnerability in XforWooCommerce Product Loops for WooCommerce (<= 2.1.2) is caused by missing authorization checks, which can lead to unauthorized access to product loop data or functionality. The issue stems from incorrectly configured access control security levels, allowing an attacker to exploit the plugin remotely without authentication or user interaction. The CVSS 3.1 score of 5.3 reflects a network attack vector with low complexity and no privileges required, impacting confidentiality but not integrity or availability.

The impact is limited to unauthorized disclosure of information due to missing authorization checks. There is no indication of integrity or availability impact. Exploitation could allow an attacker to access product loop data that should be restricted, potentially exposing sensitive information related to the WooCommerce store's product listings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin functionality or disabling the plugin if feasible to reduce exposure.