This vulnerability is an authorization bypass due to insecure direct object references in Colissimo Officiel : Méthodes de livraison pour WooCommerce versions up to 2.10.0. The flaw allows a user with some level of privilege to bypass authorization controls by manipulating user-controlled keys, potentially accessing restricted information. The CVSS 3.1 score is 4.3 (medium), indicating a network attack vector with low complexity and no user interaction required, but limited impact to confidentiality only. No official fix or remediation level is currently documented.

An attacker with privileges can exploit this vulnerability to bypass authorization controls and access data they should not be able to view. The impact is limited to confidentiality loss; integrity and availability are not affected. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for updates from the vendor. No specific temporary mitigations are documented.