This vulnerability (CVE-2026-24527) is classified as CWE-862 (Missing Authorization) and affects the Autoship Cloud for WooCommerce Subscription Products plugin by Patterns in the cloud, up to version 2.14.0. It allows attackers with limited privileges to bypass access control restrictions due to incorrectly configured authorization checks. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring low privileges and no user interaction, impacting integrity but not confidentiality or availability. No patch or official remediation level has been published as of the current data.

The vulnerability allows an attacker with low privileges to perform unauthorized actions that could alter data integrity within the affected product. There is no impact on confidentiality or availability. No known exploits exist in the wild, so the immediate risk appears limited but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and tighten access control configurations where possible to mitigate risks from missing authorization. Monitor vendor communications for updates on patches or official mitigations.