Gratisfaction CVE-2026-97297

The vendor-assigned CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, 7.6 HIGH) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L) - consistent with a Subscriber-level WordPress account, the lowest authenticated tier and typically self-registerable on sites with open registration (common for a loyalty/referral/contest plugin). The headline risk-amplifying signal is the C:H rating, which implies a Subscriber can read high-value data they should not; however, the description is a single boilerplate sentence ('Subscriber Broken Access Control') with no detail on the exact endpoint, data, or action, so the C:H driving this score cannot be independently verified and may be inflated relative to a typical missing-authorization read. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. Net: this is a plausible real issue for exposed WooCommerce stores that allow customer/Subscriber registration, but it is a vendor-CVSS-driven HIGH on a niche plugin rather than a demonstrated priority - the absence of EPSS/KEV/POC and the thin description argue for patch-when-convenient rather than emergency response, pending confirmation of the C:H claim with Patchstack.