CVE-2026-57377 describes a missing authorization vulnerability in the WPXPO WowAddons plugin's product-addons feature. This issue arises from improperly configured access control, allowing unauthorized actors to perform actions that should be restricted. The vulnerability affects all versions up to and including 1.6.8. The CVSS 3.1 base score is 6.5, with an attack vector of network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but with low integrity and high availability impacts. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthorized modification or disruption of the affected system's integrity and availability due to missing authorization controls. Confidentiality is not impacted. Exploitation can be performed remotely without authentication or user interaction, increasing the risk of exploitation. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to product-addons. Avoid exposing the vulnerable functionality to untrusted networks or users.