This vulnerability in WP Swings Points and Rewards for WooCommerce arises from missing authorization checks, allowing users with limited privileges to perform actions or access functionality that should be restricted. It affects versions up to and including 2.9.5. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

Exploitation could allow an attacker with limited privileges to perform unauthorized actions or modify data within the Points and Rewards for WooCommerce plugin, potentially impacting the integrity and availability of the plugin's functionality. There is no direct confidentiality impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should review user privileges carefully and restrict access to trusted users only. Monitor vendor communications for updates regarding patches or official mitigations.