APIExperts Square CVE-2026-115960

Exploitation requires a valid authenticated account on the target WordPress/WooCommerce site: the CVSS vector specifies PR:L, so an attacker must already possess at least low-privilege credentials (e.g. a registered customer or subscriber). The flaw affects APIExperts Square for WooCommerce versions from n/a through 4.7.5, so the Square-for-WooCommerce (woosquare) plugin must be installed and active. The limiting factors that reduce real-world risk are the authentication requirement (no unauthenticated/anonymous path per PR:L), the integrity-only impact (C:N/A:N, so no data disclosure or denial of service), and the absence of any confirmed public exploit or active-exploitation evidence. The exact feature or request handler missing the authorization check is not described in the available sources.

This is a moderate, not high-priority, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) indicates a network-reachable, low-complexity flaw that requires an already-authenticated low-privilege account (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability impact - consistent with a CWE-862 Missing Authorization / broken access control weakness where an under-privileged user can invoke an action they should not. The vuln.today decision label is 'this_month' (routine remediation), not act_now or emergency. It is not listed in CISA KEV and no EPSS score was provided; absence of these is itself a signal that there is no evidence of active or widespread exploitation. The only reference is a Patchstack database entry describing the vulnerability - not verified working exploit code - so this should be treated as a vendor-disclosed advisory rather than a weaponized threat. The authentication requirement (some valid account needed) and the limited integrity-only impact meaningfully cap real-world risk below what the 'network vector' alone might suggest.

An attacker who already holds a low-privilege authenticated account (for example a subscriber or customer on a WooCommerce store) sends a request to a plugin endpoint that fails to properly check the caller's authorization, performing an action reserved for higher-privilege users. No public exploit code is confirmed; only a Patchstack advisory reference exists. The limited integrity impact (I:L) means the attacker can alter some plugin-controlled data or settings rather than achieve full compromise.