The Appy Pie Connect for WooCommerce plugin for WordPress contains a privilege escalation vulnerability (CWE-620) caused by missing authorization in the reset_user_password() REST API endpoint. This flaw allows unauthenticated attackers to reset passwords for any user, including administrators, thereby gaining administrative control over the affected WordPress site. The vulnerability affects all versions up to and including 1.1.2. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation enables an unauthenticated attacker to reset passwords of arbitrary users, including administrators, resulting in full administrative access to the WordPress site. This compromises site confidentiality, integrity, and availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API endpoints if possible and monitor for suspicious activity related to password resets. Avoid using affected versions of the plugin in production environments.