Product Catalog Enquiry CVE-2026-81792

No authentication is required (PR:N) and no user interaction is needed (UI:N), meaning any attacker with network access to the WordPress site's HTTP/HTTPS interface can attempt exploitation. The plugin must be installed and active on a WooCommerce-enabled WordPress site running version 6.1.4 or earlier. No non-default configuration or special deployment mode is required. Exploitation is bounded by the plugin's functional scope: the CVSS vector specifies no confidentiality impact (C:N) and limited integrity and availability impact (I:L/A:L), so the attacker cannot leverage this flaw alone to read sensitive data or gain persistent server access. The unchanged scope (S:U) means exploitation does not escape the plugin's own context to compromise the broader WordPress installation or host operating system.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) reflects a meaningful but bounded risk: the attack requires no authentication, no user interaction, and is network-accessible with low complexity, making automated exploitation trivially scriptable. However, the constrained impact metrics (I:L/A:L, C:N, S:U) indicate this is not a full administrative takeover; the attacker can perform specific restricted plugin actions with limited integrity and availability consequences, rather than gaining persistent access or exfiltrating credentials. No EPSS score was provided in the input data, so probability-of-exploitation cannot be numerically compared. No KEV listing and no publicly available POC lower urgency relative to a critical-impact flaw - even a mid-sized municipal IT team in tczew should treat this as a medium-priority patch given the authentication-free network entry point on any live WooCommerce site running this plugin. The unchanged scope (S:U) confirms exploitation is contained within the plugin's own functional boundary and does not propagate laterally to the broader WordPress installation or underlying server.

An unauthenticated attacker enumerates WordPress plugin versions via passive fingerprinting or tools such as WPScan, identifies a target running the vulnerable plugin version, and sends a crafted HTTP POST to wp-admin/admin-ajax.php with the plugin's privileged action parameter. Due to the missing privilege check (CWE-266), the server processes the request and executes the restricted action - for example, modifying enquiry records or altering catalog settings - without requiring credentials. No public POC exists at time of analysis, but the attack pattern is standard for WordPress privilege escalation flaws and requires no specialized knowledge to replicate.