CVE-2026-107863: Missing Authorization in Codection Products Restricted Users for WooCommerce

This vulnerability in Codection's Products Restricted Users for WooCommerce plugin involves missing authorization checks, which results in incorrect access control enforcement. Versions from 0 up to 0.8 are affected. The issue allows attackers without privileges to perform actions that should be restricted, impacting the integrity of the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

The vulnerability can lead to unauthorized modification or manipulation of plugin functionality due to missing authorization controls. There is no impact on confidentiality or availability. The integrity of the system or data may be compromised to a limited extent. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently referenced, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the plugin's administrative interfaces and reviewing user permissions to minimize exposure.