This vulnerability in the FmeAddons 'Registration & Login with Mobile Phone Number for WooCommerce' plugin arises from missing authorization checks, enabling attackers to exploit incorrect access control configurations. Affected versions include all up to and including 1.3.1. The vulnerability allows unauthenticated remote attackers to perform unauthorized actions, potentially leading to complete compromise of the affected WooCommerce environment. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the plugin is not a cloud service.

Exploitation of this vulnerability can result in full compromise of the affected WooCommerce installation, including unauthorized access to sensitive data, modification of data, and disruption of service. The critical CVSS score (9.8) indicates that the impact on confidentiality, integrity, and availability is high. There are no reported exploits in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently documented, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or removing the affected plugin to prevent exploitation.