This vulnerability arises from missing authorization checks in the Live sales notification for WooCommerce plugin by PI Web Solution. Specifically, the plugin incorrectly configures access control security levels, which may allow unauthorized users to access certain live sales notification functionalities. The affected versions include all versions up to 2.3.49. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or vendor advisory is available at this time.

The vulnerability could allow an attacker to bypass authorization controls and access live sales notification data that should be restricted. The impact is limited to confidentiality loss with no integrity or availability impact reported. There are no known exploits in the wild, suggesting limited current exploitation risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's functionalities through other means such as web application firewalls or access control at the server level. Monitor vendor channels for updates and apply patches promptly once available.