This vulnerability involves missing authorization checks in the VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin, versions prior to 1.0.10. The issue allows exploitation due to incorrectly configured access control security levels, enabling unauthorized users to perform actions they should not be permitted to. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, integrity impact, and no availability impact.

An attacker can exploit the missing authorization to perform unauthorized actions that affect the integrity of the system or data managed by the plugin. There is no impact on confidentiality or availability according to the CVSS vector. This could lead to unauthorized modifications within the affiliate marketing plugin's functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's administrative interfaces and monitor for unusual activity related to affiliate marketing functions.