This vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin (versions up to 2.2.5) involves an authorization bypass caused by improper access control configuration. Specifically, a user-controlled key can be exploited to circumvent authorization mechanisms, allowing unauthorized actions that should be restricted. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows an attacker to bypass authorization controls, potentially exposing some confidential information and causing limited disruption to availability. There is no indication of integrity compromise. No known active exploitation has been reported, but the issue could allow unauthorized access to functionality or data within the affected plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting access to the affected plugin functionality if possible. Monitor official WP Wham and WooCommerce channels for updates and apply patches promptly once released.